Here are a couple of examples of sites which could be major opportunities for identity theft if an account gets hacked:
- British Gas -- customer login for paying gas/electricity bills -- doesn't allow special characters
- Virgin Media -- customer login for broadband, email, personal webspace, and telephone / TV billing -- passwords must be 10 characters or less
These are ridiculous. Ask any security expert. Special characters are a major boost to password security, and it is preposterous to limit a person's ability to use a pass-phrase consisting of multiple words.
Part of me really hopes that the web-developers responsible for these get their identities stolen online and lose all their money. Poetic justice. :D