The problem is that you (hopefully) hash the passwords, so they all end up with the same length.

The eBay password limit is 256 characters.

They made the mistake of mentioning this when I went to change my password.

Guess how many characters my eBay password has?

I sort of get it. You don’t want to allow the entire work of Shakespeare in the text field, even if your database can handle it.

You don't store the original text. You store the hash of it. If you SHA512 it, anything that's ever given in the password field will always be 64Bytes.

The only "legit" reason to restrict input to 16 character is if you're using an encryption mechanism that just doesn't support more characters as an input. However, if that's the case, that's a site I wouldn't want to use to begin with if at all possible.

Even 255 bytes with 10 million entries is only ~2.6GB of data you need to store, and if you have 10 million users the probably $1 a month extra that would cost is perfectly fine.

I suppose there may be a performance impact too since you have to read more data to check the hash, but servers are so fast now it doesn't seem like that would be significant unless your backend was poorly made.

Invalid password, maximum 13 characters.

Yep. Having to have requirements that doesn't flow with people very well and requiring constant updates, people WILL find shortcuts. In the office, I've seen sheets of paper with the password written down, I've seen sticky notes, I've seen people put them in notepad/word so they could just copy paste.

This is made worse, because you have to go out of your way for a password manager, which means you need to know what that is. And you need a good one because there has been (and I'm going to generalize here) problems with some password managers in the past. And for work, they have to allow a password manager for that to even be an option. Which you then end up with this security theater.

the password cannot contains the same sequences of characters as the old password.

and i have seen this requirement in a service that requires changing it every month for some reasons.

and this is to manage a government digital identity that allows to log it in all governments websites.

Usually 256 bit hash is used. 256 bits is 32 bytes or 32 characters. Of course you are losing some entropy because character set is limited, but 32 characters is beyond reasonable anyway.

I just double checked and I have TOTP enabled for my PayPal account so it should be an option.

I just found this support article of theirs and it says it can only be enabled through their website and not through the app (why?!) so you might be running into that?

https://www.paypal.com/uk/cshelp/article/what-is-2-step-verification-and-how-do-i-turn-it-on-or-off-help167

That last part definitely isn't true.

Darn, can't use the entire Bee Movie on Blu-Ray as my password then.