I wrote about this a few months back: <a href="http://devthought.com/blog/server-side/2009/09/on-the-subject-of-login-forms-security/" rel="nofollow">http://devthought.com/blog/server-side/2009/09/on-the-subjec...</a>