Changing password should zero the count of failed logins.

[basefont]

Failed logins are counted to warn a member when someone is trying to guess the member's password. Therefore, the count of failed logins should apply to the current password. It should be zeroed when the password is changed. I have patched it in my tree. This does not zero the count when the superadmin's password is changed by send_sa_password_reset().

basefont@25ee967

[cypherbits]

I would do it on successful login, not password changing.

[basefont]

This patch doesn't affect the check on login. Why do you want to retain the count of failures after the password has been changed?

[DanWin]

Changing a password doesn't have much to do with the number of failed logins. Regularly changing your passwords is a good idea, but it won't change the fact that there are failed logins, regardless of what your previous password was. I also think that it's best to only reset the counter on login, not when changing the password.