> please allow long passwords at least 64 chars long; even 256 should pose no DoS risk whatsoever

With a very large user database, a 256 char entry field would really start to add up, wouldn't it? iirc the DB takes up that room whether it's fully used or not. Size affects not just disk but also bandwidth, memory, cpu, and has an overall effect on system performance