|
How about something simple like not letting users pick their own password..
Autogenerate a random one on signup.. they click a link in email to be taken to a page on the site to get the password...
auto-expire it every couple months and go thru the process again.
|