My bank limits you to 20 characters, which I'll grant is decent.
But: NO non-alphanumerics, and, get this, is case insensitive.
This may just convince me to switch banks...
American Express' passwords are now case-insensitive too. Incredibly, this still qualifies as a slight improvement over their previous password regime, which used a maximum of eight characters, few "special" characters accepted.
My bank is about to roll out a new online banking system. They are requiring us to create a new password for the new system. So in order to log into the new system for the first time, they emailed us telling us to email them back a 6 digit pin to identify ourselves for the first login. My response is to start looking for a new bank.
Yes, I was just going to mention banks as well. I have dealt with multiple online banking systems for major banks that enforced ridiculously low maximum password lengths and alphanumeric-only restrictions. It's one thing for Electronic Arts to have not thought through this stuff, but another entirely when you're talking about a banking system.
My school only gives you a four-digit numeric PIN, and it defaults to your birth date.
Enforcing PIN style password for bank is not that bad, as long as they use other factor to identify you.