Can ECB mode really leak some characters? In an Ars Technica article about Adobe's use of 3DES in ECB mode, there's a paragraph


  The passwords, according to password expert Steve "Sc00bz" Thomas, are encrypted in a mode known as ECB. That was a poor choice on 
      the part of Adobe engineers, because ECB often leaks information about the passwords, such as their last few characters and some of 
      their lengths. In certain cases, for example, passwords that end in e will generate an encrypted string that ends in 
      n2auThm2+Q==; those that are nine or 17 characters long will sometimes end in mfZq5OGbb5.


Is it really the case?
The article mentions that 3-DES was used to encrypt these passwords in ECB mode. DES has a 64-bit/8-byte block. 

So let's say you use ECB to encrypt a nine byte password. The first 8-bytes are encrypted using ECB. So far so good. 

But what happens when we come to the ninth byte? Well we're now in a new block but only the first byte is populated with any data. The rest are zeros (assuming no padding is used). 

This means that there are only 256 possible encryptions of the second block for all nine byte passwords. With a large enough database, it will be relatively easy to guess what these encryptions are. If you had a dictionary of common nine character passwords, a mere frequency analysis of the last character of the password and a comparison to the frequency of the second ECB blocks would be enough! 

So yes, the paragraph is correct. It's a significant hole in the scheme they used.