From a password security standpoint, I largely agree. You can open yourself to system attacks by allowing arbitrary length input. You should have some kind of limits on any user input.