Let's play a game.
Theme: Security awareness - grey-hat style.

How to play:
Post the name of the site followed by actual bad-password restrictions of well-known companies in the comments.

If no-one beats me to it, I plan to share some of the more alarming ones(or all) on a twitter and tag the relative companies as well as various security enthusiasts.