Yeah, that's the same sort of thing I think about whenever I see this crap too. It's understandable with banking systems, they're often forced to interface with

Yeah, that's the same sort of thing I think about whenever I see this crap too. It's understandable with banking systems, they're often forced to interface with old and antiquated mainframes with formal constraints, but it's simply unacceptable in a modern system. Even if the solution winds up being storing the hash as the credential and simply hashing it in transit with middleware, it's better than this garbage.