Isn't there some initiative by now to actually educate people on proper password security?

My bank does the same bullshit, 8 characters alphanumeric at most.

This kind of thing drives me crazy. Why not allow special characters? The only conceivable reason is so that your app doesn't get SQL-injected or otherwise hijacked -- which is why God invented the character escape.

Limiting the number of chars as a security measure? I'd make fun of this but it's just too easy and stupid.