Note also that an enforced length limit is sometimes an externally visible code smell of not performing proper password hashing, and instead storing the plaintext password in, i.e., a char(8) db column.
I like how the story ends:
The Internet is full of chimpanzees.