While it's true their changes made the key space smaller and, even with a good KDF, 8 chars was never long enough to begin with, the reduction is negligible. As

While it's true their changes made the key space smaller and, even with a good KDF, 8 chars was never long enough to begin with, the reduction is negligible. Assume 36 char (alphanumeric, case insensitive) passwords: Originally: 36^8 + 36^7 + 36^6 + 36^5 + 36^4 + 36^3 + 36^2 + 36 2,901,713,047,668 possible passwords ~41.4 bits After: (36^8 - 26^2 * (8*7)/2) + (36^7 - 26^2 * (7*6)/2) + (36^6 - 26^2 * (6*5)/2) 2,901,650,810,624 possible passwords still ~41.4 bits Only 62,237,044 possibilities eliminated. Length is the most important factor, so this was probably a good decision if most of their users were using <= 6 char passwords, or not using numbers at all. And frankly, the financial sector should be using HSMs anyway, making weak KDFs irrelevant.