I am happy to hear that you are aware and agree things could be better! And ofcourse also that there is plans for improvement
Admittedly 20 characters passwords is kinda 2000s
That said, no SSL is imo really an issue, hopefully you'll take that along in the upgrade at least, even tho I really see no reason at all not to have a cert for anything these days
