The worst are forms that don't tell you there are complexity requirements until they're submitted.

Recently I managed to register an account with a password that the login page rejects. I had to hack the frontend script just to log in. And it's my insurance company.