At some point you do need a limit: you don't want a 1GB password being transferred, of course. But the low limits you often see is somewhat lazy use of fixed-le

At some point you do need a limit: you don't want a 1GB password being transferred, of course. But the low limits you often see is somewhat lazy use of fixed-length hashing algorithms (shorter than the algorithm length: just pad; longer than the algorithm length: refuse, instead of using a different hash or figuring out how to combine multiple hashes).