[eluser]jdfwarrior[/eluser]
Both, in theory, could be cracked it just becomes infeasible to do so, due to the amount of required to do it. MD5 is a 128bit hash where SHA1 is 256bit. The MD5 algorithm is more likely to generate a collision than some of the better hashing algorithms.
Agreeing with Dam1an on the lockout policy. It could become a real headache. Never underestimate a user's stupidity
Some people can't remember their password from day to day. Sad, but it happens. You would go crazy resetting passwords for people every day.
"most member hate the string except A-Za-z0-9" - meaning what? They hate the length requirement? They can hate it all they want, the length requirements NEEDS to be there. Without it, I promise you, you would end up with users having passwords like, "Ab1". They would probably end up using their initials and a number.
Set good password requirements, use a good hashing algorithm, and limit the number of attempts within a certain time period. If the user exceeds that, lock them out for a predefined amount of time. You should be good with that.
