I frequently encounter questions about the reasons behind password policies and restrictions (Example1, Example2), the easiest example being the maximum length restrictions. The overwhelming consensus is that these policies are almost entirely bad and/or indications of bad behind-the-scenes password management.
However, several prominent companies for which I have usernames/passwords still have these password policies. I am concerned, in particular, because several of these companies keep or transmit money.
So: Regardless of why a particular company has these bad policies, is there a way to get a company, sometimes a large, sluggish corporation, to get their password management up-to-date?
I am looking for concrete methods or routes to use (are these companies risking violating consumer protection laws? can their IT departments be found and interviewed at a security conference?), not vague answers like "start a Facebook movement to publicly ridicule the company."
