Are there good reasons for either setting an upper length or excluding characters in passwords?
I'm going to make a guess and say that some of these restrictions are due to character filtering on their website (
& < > #) to keep hackers out. While others are the bone-headed ideas that come out of committees of pointy haired bosses.
I've come across a number of really stupid (in my opinion) "security" decisions. As an example, one large investment company handles my IRA accounts as well as my pension. In order to do any contact with the pension requires me to type in my password on the telephone (you cannot reach them otherwise). My brokerage/IRA account uses letters (upper and lower case) as well as some punctuation - none of these characters appear on a telephone number pad. If you can't log in with the password over the phone, it lets you reset your brokerage account's password to something you can type in over the phone.
My payroll system (for the consulting company I work for) requires numbers, and only numbers - this lets them use the same database whether the user calls in (I've never done this) or uses the web interface (I only use this).
That being said, it is time to change my password at the office. They have such crazy restrictions that I estimate it will take about half a day to find a password acceptable to the system: at least 2 upper case letters, at least 2 lower case letters, at least 2 digits (which cannot be +/- 1 from the previous password's), at least 2 non-alpha/non-numeric characters, cannot match any of the last 24 passwords, cannot contain any string (forwards or backwards) that is a word (3 or more letters long) in English (also a couple other languages I don't have clearance to know). I think the minimum length is like 10-11 characters.