Responsible disclosure in open source: The crypt() vulnerability

For instance, the algorithm treats all passwords greater than 8 characters to be equivalent to the first 8 character prefix of those passwords. (the password "password" is equivalent to the password "password hashing is hard")

It's documented to only look at the lower 7bits of each character as well, so "ůh?" is equivalent to "Eh?", I believe, etc