"It's just bad security." In general maybe but if you have safeguards in place such that 16 character passwords can't be bruteforced than you don't gain much b

"It's just bad security." In general maybe but if you have safeguards in place such that 16 character passwords can't be bruteforced than you don't gain much by going to 256. Every hack/stolen account I've ever heard about was spoof login/keylogger/MITM, social or same p/w from another service that kept it in plaintext. I'd guess some people just got hacked because they use the most common p/w's ("12345678", etc.). 256 characters wouldn't help any of those people