From time to time I see systems that don't allow passwords longer than 8 chars: isn't that a security risk? What am I missing, here, that might have lead to such decision?
Yes, absolutely, it is poor design from a security perspective. You're not missing anything. It could result from historical inertia (a lousy excuse) or from ignorance.