Ask HN: Are there any places that name & shame sites with shitty security?

If there isn't one yet, shall we make it?

After getting frustrated that my bank won't let me have a password with symbols in it (seriously??), I sent them a message. The boilerplate reply I got doesn't fill me with confidence, so I'm wondering:

Is there a way to report offending sites like this?

A) Report a site/company that has shitty security practises. (They're storing passwords in plaintext, limiting strong passwords, are open to some attack)

B) Bubble up the worst offenders, show the list to the world.

C) Provide them with directions to literature so they can take steps to improve their situation if they care. (And allow some discourse, so they can respond to the public about their problems and what is being done about them)