Of all the websites, businesses, forums and even Government sites that I use, by far the worst for password security is my bank!
They only allow 6 characters, letters and numbers only. No special characters! What a joke!
No two-factor with login, although they have authentication for transactions, after login.