My favorite one was a site that capped the password length in the creation form in a way you couldn't tell it was being truncated, but then let you enter any length when you logged in. And being a finance thing, it blocked your password after three attempts.