You know what the worst is? When they limit you to, say, 20 or 32 characters, but accept a longer password and silently truncate it!

I've run across that at least once and it was a total pain to troubleshoot and figure out.