What reason could a system have to limit the length of a password to 8 chars?

Question

From time to time I see systems that don't allow passwords longer than 8 chars: isn't that a security risk? What am I missing, here, that might have lead to such decision?

Answer 1

Yes, absolutely, it is poor design from a security perspective. You're not missing anything. It could result from historical inertia (a lousy excuse) or from ignorance.

See What technical reasons are there to have low maximum password lengths? and Do passwords need a max length?.

Answer 2

The reason is saving space. In the old days every byte was precious, and security didn't matter because everyone was a nice person.