Rate password complexity level

[johana-star]

No description provided.

[johana-star]

Once implemented, we can use this to:
A) Provide users a quick gauge of how effective the password might be
B) automatically reject passwords below a complexity threshold.

[heartpunk]

I vote for a different approach to this. The main risk is having too short a password, so we should limit either minimum word length, or minimum password length. Past that risk, the concern is whether you're using enough words for the value of the information being protected. I propose a breakdown of, not complexity, but difficulty of cracking using a character by character brute forcer, as well as by using a brute forcer specific to the values used by this project. We could provide a pretty realistic estimate of the actual cost of brute forcing the password using current EC2 rates, too, and that'd be kinda cool.