passwords are not attacked with random noise, a 55 letter password of 7 common words has way less entropy that 256 random bits. in my opinion password size sho

passwords are not attacked with random noise, a 55 letter password of 7 common words has way less entropy that 256 random bits. in my opinion password size should be oriented towards preventing DoS attacks, little more (also you can prehash the password on the client with a quick non-password specific but still cryptographically strong hash and then use a proper hash server side, so that on the network all passwords are 256 bits