Password policy discussion

[abretaud]

Several things to discuss:

• do we ask for password renewal?
  • regularly?
  • on each extension?
• do we reconsider password content?
  • inria no longer put constraints on content (don't know for size)
    • but they use 2FA auth on many web apps
  • ansi recommends the rules implemented in Password rules enhancement #492
• do we make the rule customizable by site?
• do we implement somehow 2FA? (webapps + ssh)