Currently, the password strength control is very poor (e.g. passwords with a single character are allowed). We should improve the required password strength to protect the users from being compromised (either manually or by automated means).
OWASP has a great guideline that we could follow.
