title: Should I impose a maximum length on passwords?
body: <p>I can understand that imposing a minimum length on passwords makes a lot of sense (to save users from themselves), but my <strong>bank</strong> has a requirement that passwords are between 6 and 8 characters long, and I started wondering...</p>
  
  <ul>
  <li>Wouldn't this just make it easier for brute force attacks? (Bad)</li>
  <li>Does this imply that my password is being stored unencrypted? (Bad)</li>
  </ul>
  
  <p>If someone with (hopefully) some good IT security professionals working for them are imposing a max password length, should I think about doing similar? What are the pros/cons of this?</p>