* max 64 chars “should” requirement? vs. no truncation?
* what about pin-codes?
* the password process is still very much a hot mess, standardize registration, IIA, updating, cancellation
* protection of passwords at-rest, salt your passwords
There kind of needs to be a truncation at some point. Otherwise there is a risk of an attacker triggering a denial-of-service attack by sending multi-gigabyte passwords.
I've seen a service whose registration form accepted my 64 characters long randomly generated password, but then the login form apparently truncated the password to something smaller, silently, and just said my password was incorrect. I then had to guess what was happening and reset my password to something shorter, which worked. If you must have a stupid password policy at least make it explicit (well, and consistent).