Aye, but people do. Often. I suggest to people that they set up a system that uses some permutation of the domain name or company name to uniqueify their pass

Aye, but people do. Often. I suggest to people that they set up a system that uses some permutation of the domain name or company name to uniqueify their passwords. This way, you only have to remember one password, plus your system, and you have unique passwords everywhere. On the subject of red flags during signup, a password length restriction is always a red flag to me. If you're hashing my password, you don't care how long it is, right? If you limit length, I assume it's stored in plain text.