Silent truncation is another gotcha. They drop everything after character 8 (so it fits in the database?). Then they change the schema, and stop truncating at 8 characters, but only on some forms. Oh, the joy.
MSN and Hotmail used, and maybe still do this, after 14 characters.
My bank does it after 6! It even reminds you that it is 6 chars max on the login page.
Now it's 16 characters at Hotmail.
I think the common problem of silent truncation after 8 characters suggests they are using the (outdated) crypt(3) API. The man page says "By taking the lowest 7 bits of each of the first eight characters of the key, a 56-bit key is obtained."