title: Best practices for web login / authentication?
body: <p>Writing the code for the user authentication portion of a web site (including account registration, logins, and password resets) is pretty simple, but what do you need to make a really <em>good</em> user authentication setup?  For example, I'd consider not storing plaintext passwords to be a bare minimum requirement for a web site, but that piece of advice seems to be largely transmitted by word of mouth, and plenty of sites still fail to follow it.</p>
  <p>What is some other good advice or good requirements for the user auth portion of a web site?  For example, should usernames be user-selected, or should they be email addresses?  Any pitfalls for the user registration portion?  (CAPTCHAs are probably worth a whole topic by themselves.)  Any pitfalls for the password reset portion?  Anything else?</p>
  <h3>Edit:</h3>
  <p>Somewhat duplicated here : <a href="https://stackoverflow.com/questions/243957/best-practices-for-login-pages">best-practices-for-login-pages</a></p>