It is quite feasible to try to brute force you own users passwords. Run a background job that tests against common passwords and close variants, and if it is to

It is quite feasible to try to brute force you own users passwords. Run a background job that tests against common passwords and close variants, and if it is too simple, either force a harder one, or force email auth if any of their metadata changes (IP, ASN, browser fingerprint). C.f. https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords