Isn't the password length check done locally on the machine (with javascript or similar)? If so, an attacker could easily ignore that check and send as much data as he want.

The check on that should (and, AFAIK, is) done server-side, with the server closing the connection after a certain amount of data or time.