Even stupider are sites that require exactly N characters. Also, they usually pick small N for that as well.
I know a local bank that limits password lengths to exactly 7, and the contents of the passwords to ONLY DIGITS. I can't imagine how many users are going to just use their phone number.