How does an attacker find out how long your password is, if you don't tell them? I'm open to the idea that maybe somehow that can be done through some trickery, but I don't see how.