We've covered length limits before (and entered it into our mandate), since those limits are many times created by placing the password into a fixed-width field in the database.