T-Mobile has a fun one. When creating the account they let me set a IIRC 6 digit account security PIN, but when setting up online access they only accepted a 4 digit PIN necessitating a call to customer service to reset the PIN.

Bonus Points: resetting the PIN had almost no security checks making it completely worthless as security

Swiss bank Cler is guilty of this too, in a way.

At (initial) password change they allow plenty of characters, but it is truncated without notice. After the password change, at login, it does not get truncated and you are not able to login, nor can you change your password ever again (until a password reset via mail (no email) arrives. Fun times.

HSBC UK does this.

> You can’t just let users paste in 18,000 characters

Thank you for speaking up. And here it is: I don't trust you with my data.

Passwords should not be stored in a database. Period.

So how do you check a password if you can't store it? Hash it with a salt. This results in a fixed width output, regardless of the password size.

If you are setting a max password, it's because you are trying to store it as-is, which is why I don't trust you to store my data.

Edit: I also think it makes sites that do this a target security wise. It's like advertising ignorance.