In reply to Gerry.

Brute forcing is not a security problem (unless you have a stupid password), it's a performance problem, as your site can get taken down due to it.

What changes do you think should be made in core? I think a minimum password strength should be enforced.