A company that my retirement plan used to be with was worse than that. The password could only be numbers and letters, and they would silently truncate your password to 8 characters. The worst part though, is the password was stored in a way that it could be entered on a touch tone phone. So case was silently ignored for letters, and the characters "2abcABC" were all stored as the number 2, and so on for the rest of the buttons on the phone. They also didn't support two-factor authentication. They've since updated the password requirement to something more sane, but it was baffling that they would ever do that.