Improvements to account creation

[CarwynNelson]

• Password strength checking
• Throttling of login attempts

[jamesgeddes]

Is django-password-strength of any use?

Also, (future improvement) this would be a great place to include the Geek.Zone affiliate link to LastPass

[jamesgeddes]

I'd argue that password length is more important than complexity, see

• XKCD
• UK NCSC

I do agree that login throttling, 3 bad login attempts every hour for example, is a good idea. We could combine this with an email to the account holder, something like, "Someone just tried, and failed, to log into your Geek.Zone account. Your account is safe, however just to be sure you might like to change your password."

[jamesgeddes]

Would recaptcha be a better first step than blindly throttling? I've created keys for geek.zone, where should I put them?

[jamesgeddes]

Split to #43

[jamesgeddes]

@CarwynNelson and I have agreed that we will change the password length to 9. Should ideally use the built in methods to check for common passwords. Post MVP we could have a password strength indicator that only goes fully green after 16 characters.