This seems like such a simple and fundamental idea, why isn't every web site with access control doing it? I'm sure it's been done on the web before but rarely

This seems like such a simple and fundamental idea, why isn't every web site with access control doing it? I'm sure it's been done on the web before but rarely and usually not so well. Of course, it's the same thing you get on logging into a shell account and using "w" or "last" but doing it on the web is really a big deal. I particularly wish the bank/credit card web sites I use would give me an access log instead of doing things like asking you tell them who your fourth-grade teacher was or whatever when you switch computers or making you change passwords every ninety days.