Accepting long passwords may mislead people to use passphrases, the first 8 characters of which are very vulnerable to a dictionary attack. If you're only going

Accepting long passwords may mislead people to use passphrases, the first 8 characters of which are very vulnerable to a dictionary attack. If you're only going to consider the first 8 characters, you should make it impossible to type more than 8 characters on the entry form.