Are longer passwords really safer against brute force attacks? If we take two password strings of different length and attempt to bruteforce match them, it is obvious that the longer one will take longer to crack on average. However if we assume that when selecting a password our maximum password length is given ,does it really matter how long the actually selected password is, if it is then padded to the maximum length? 

Example:

Max Length: 10 characters

Password A: "abc" -> padded to "abc0000000"

Password B: "abcdefgh" -> padded to "abcdefgh00"

Now we have two strings of equal length, which theoretically should both be equally hard to crack, despite the actual password entered being shorter. This assumes that the padding technique is of course kept secret.

Is there anything wrong with this reasoning? Is this actually done in practice? If not, why not?
If we take two password strings of different length and attempt to bruteforce match them, it is obvious that the longer one will take longer to crack on average.


Actually, that might be obvious to you, but it's not true.

A brute force search is one where an attacker has a long list of passwords, and tries them in succession.  Now, if the attacker is at all intelligent, they'll put passwords that are likely to occur near the front of the list, and unlikely ones near the rear.  That is, the 'goodness' of a password is not its length, but instead how unlikely it is to guess.

In particular, a password of 123456789 is considerably worse than a password of 2u,7J$n even though the latter is two characters shorter.

And, because the entire strength of a password is how unlikely it is to be guessed, a fixed transform (like you suggest) will add no strength.  If the attacker guesses the real password abc, they'll run it through the known transformation, yielding abc0000000 and check that against the underlying password logic; that has the same likelihood to succeed as it would have been if we had not added the 0 characters.