When a system requires a password between say 6 and 20 characters in length, does it mean the password is stored without using a hashing function, and that the mysql-field (or similar) is 20 characters in length?
Is there any reason to have a maximum length if a hashing function is used?
I'm thinking maybe a DOS-vulnerability when hashing huge passwords. A ~100 character limit should be enough to stop this, without disturbing users. Maybe even cut the password at a specific length before hasing it?