I have also found that the Forgotten Password reset displays that error message “Sorry, but you must enter a strong password” no matter the password strength. So user based password resets are not working at all.
I don’t see the password strength meter on the Forgotten Password reset page like on the Profile page (not sure if it is even supposd to be there).
This is pretty unfortunate, since strong password enforcement is fundamental security measure, and yet we need to turn it off.
