I know of an easy way to remove 33% of that ...
Email addresses are globally unique, and everyone already knows theirs ... email + password seems like a simple, well accepted and workable solution.
Right ?
My appleId has an @mac.com email address which means it is for some reason immutable - I can not change my address. Jobs only knows where emails from apple to me end up, I really don't do much with my appleid anymore other than re-authorize the appstore every month when I need to update xcode.
For a couple of service-oriented sites I'm working on, which won't have forums or public issue trackers, they only use email address (which is change-able). But, it's just not an option for my primary business website.