I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, etc.) are used, and whether it can be located in a rainbow table) to limit how much damage their account can do if compromised.
I don't have an application for this idea yet, but say I'm writing a forum or something: Users who use 1234 as a password might have to fill out a captcha before posting, or be subject to rigorous anti-spam measures such as timeouts or Bayesian filters rejecting their content. If this forum is very hierarchical, allowing for "promotion" to moderators or whatever by some means, this would either stop them from gaining privileges at all or telling them they have privileges, but not letting them exercise them without a change to a more secure password.
Of course this couldn't be the only measure of security, but it might go well next to otherwise good security practices.
What do you think? Is this just overdoing it, stealing focus away from more important security practices, or is it a good way to limit risk and encourage users to use safer passwords (and hopefully convince people you are using good security practices)?