Er, wait a second, how is it even possible that they validate my login just typing the first 16 chars of my old (longer) password. Were they clipping passwords to 16 chars before and not telling anyone? That sounds bad, but the alternatives sound much worse.