Eh. No worries.

I expect a relatively small minority of the HN crowd have exposure to decades-old mainframe systems.

It seemed a plausible rationale, given the state of the world ~2000 when PayPal was ramping up was very different.

Especially in the financial sector, I can see partners and/or requisite systems to interface with being heavily mainframe-based.

And now, even if PayPal is following best practices, it's possible one of their counterparties is stuck in the 1980s. People forget that "building Fort Knox around a private line from X DC to Y DC" is sometimes cheaper than "rewrite COBOL system of record that no one alive worked on."

"Mainframe" doesn't seem like an actual answer to me. Why can't mainframes handle passwords longer than 20 characters? Are mainframes incapable of doing password hashing? Can't modern databases have text fields with a max of 20 characters, why is that problem unique to mainframes?