Mistake #9: Not Telling Users the Requirements for Username and Password Up Front

Mistake #10: Requiring Stricter Password Requirements Than The NSA

Mistake #11: Using Challenge Questions They Won't Remember In A Year