[protagonist]

the question is, since when does it matter how secure a password actually is anymore? just have a maximum number of attempts from a given IP to stop people from doing the brute force method.

it makes no sense to force people to have certain passwords when the only way in which they actually are compromised is by having their whole computer's security being compromised. when the user's security is bypassed it doesn't matter if the password is "bugger" or "ijs8Ej9" or whatever, because they are equally easy to steal if a trojan is present.