I think the OP should name and shame the site that takes passwords over a non-secure connection, stores them in plain text, and silently truncates long ones. Maybe that would get them to fix it.
I guess that's an example Full Disclosure vs (as an alternative) Coordinated Disclosure; http://en.wikipedia.org/wiki/Full_disclosure_(computer_secur...