[kgrin]

Err... what's a plausible reason passwords would be restricted to 20 chars, other than being stored in plaintext in a char(20) field?

[0942v8653]

Making sure you can't DDoS by sending gigabyte passwords for the server to hash. Of course 20 is seriously … overprotective.

[mgkimsal]

Pretty sure nothing's stopping me from sending a gig of data to their server anyway.

[0942v8653]

No, but hashing is much more intensive than just receiving it.