My biggest surprise when resetting a bunch of passwords from the Sony hack was the fact that Paypal wouldn't let me use a complex password like the one in the article (no longer than 16 [or something like that] chars, no quotation marks, etc.

For another service, I would have thought that'd be okay - annoying, but okay. But a service with access to a whole bunch of my money? Not cool.

Perhaps it's changed since, but still, the fact that it once was that way is bad enough.