8 More Design Mistakes with Account Sign-in (via) Second of a two part series by Jared Spool. I agree with all of them with the possible exception of #15 which advocates providing a non-email password recovery solution. Security “questions” are usually dreadfully insecure, and introduce the need to lock users out of their accounts after just a few tries.
Sign in with 
OpenID
I don't entirely agree with #13 as he wrote it in the headline. Allowing username phishing by explaining when the username does or doesn't exist is not cool. However, he recovers lost ground slightly with the first example which is a bit more subtle (almost too subtle).