I use automated high-entropy password-generators and a surprising amount of websites cap lengths to 30-50 characters (or even 8 chars sometimes like a Canadian bank I won't name). Allowing super-long passwords would be a good starting alternative to SSL.