"your password strength is getting cut in half" - which is only the icing on the cake. As soon as the other side manipulates the plaintext version of your passw

"your password strength is getting cut in half" - which is only the icing on the cake. As soon as the other side manipulates the plaintext version of your password, it is reasonable to assume that THEY ARE PROBABLY STORING THE PASSWORD REVERSIBLY. Whoa. (To be precise, they could be lowercasing the password client-side; but every case of "hello, we've mutilated your password" I've seen so far has been down to "oh, and we're storing it in plaintext; is that bad?").