I was under the impression that Vanguard's U2F fails open if your password is over eight characters long. Is that still true?