I recently ran across this when logging into MSDN. (I saw this screen after typing my initial credentials.)
I have a 20+ digit password, however there's apparently a new requirement for Microsoft accounts for password to be no more than 16 digits in length. If I type in the first 16 digits of my password, I'm able to log in.
That got me thinking: if passwords are being stored as one-way hashes, a hash from a 16-digit password and a 20-digit one are not remotely similar. You cannot validate a 20-digit hash using only the first 16 digits.
If Microsoft is properly-storing passwords (salt & hash), how can they validate a shorter version of my password?