I recently had to create accounts for work benefits at TWO different sites that had user name complexity requirements, and actually rated the strength of my user name! That's something I had never seen before, and it seems pretty misguided.

The worst of these also had a 20 character password limit (at least it wasn't 8!), along with several of these nonsense requirements that limit repeated characters. I couldn't manage to generate a password they would accept. Eventually I realized that not only did they allow only certain specific special characters, but their password length validation was wrong and would only accept 19 characters because they were testing for <= 20.