As far as best practices wrt. security, I've been a long-time fan of the OWASP ASVS checklist: http://code.google.com/p/owasp-asvs/wiki/Verification http://code

As far as best practices wrt. security, I've been a long-time fan of the OWASP ASVS checklist: http://code.google.com/p/owasp-asvs/wiki/Verification http://code.google.com/p/owasp-asvs/wiki/Verification Both apple and amazon are in violation of V2.9: "Verify that users can safely change their credentials using a mechanism that is at least as resistant to attack as the primary authentication mechanism." Clearly the secondary authentication controls are weaker than the primary authentication controls. It would be so awesome if all the common web app providers published ASVS compliance reports. Never gonna happen though.