Ask HN: How to encourage my service to improve security?

The pattern of the company with risky password policies that doesn't respond well to criticisms has become pretty cliche by now.

And I learned today that a pretty important service I use has such a policy. Rather than berate or try to shame them, are there any techniques for feedback that are likely to effect change, or is it most likely a lost cause?