[Paul]

Excellent hack! I just read the thread over at vb.com regarding this being implemented in vB3. I'd have to agree with a few points made here already:

This should be optionally definable by usergroup. For some sites, this may only be useful with moderators.

Once the period of time for an expired password has past, an option to set a new "strong" password (consisting of lower and upper case letters, numbers, and symbols--i.e. "Fe93Fdksi#@fksDF") which is randomly generated and e-mailed to the user automatically.

For really superb security, in addition to the above, xx previous passwords should be remembered and prevented from being used for xx password changes. There should also be an option to limit the amount of time between password changes (so that a user doesn't change a password xx times to be able to use the same one again--perhaps one password change per day?)

"Locking out" the account for a specified amount of time or until an administrator unlocks the account would be terrific as well.

I am thinking of mirroring the Windows 2000 Active Directory security model, for those who might be familiar with that. What a great addition this would be for vB!

Paul