I started keeping track of websites and applications that don't really get security and other things that got me a little fired up and I figured I'd post at least the security types.
There's several different categories I have found, this could get cumbersome:
Accepts password on portal even though it doesn’t work when you try to use it to log in. If you don’t accept certain characters please specify them, test for them and fail if they are used.
OpenText
Eaton UPS settings
Emails your password in clear text whenever you change it.
Limits you when creating a password
HomeAgain - 8 characters max, numbers and letters only but remembers the last 5 passwords and won’t let you re-use
Eaton UPS 10 characters, no mention of this anywhere
Adobe Creative Cloud, 6-12 characters
Microsoft, 16 characters, used to be more
Citibank, not case sensitive
What can you add to the list?