- support very long passwords, so that users can use pass-phrases if they like.
- use bcrypt or the like for storage
- do not create easily cracked side channels, like a fixed set of "security questions" for forgotten passwords
"Do these jeans make me look fat?
"Why is everyone staring at me?"
"Is there something in my teeth?"
"Are they talking about me?"
Bank of America, for example, foils 1Password by spreading login across two forms and using a custom, non-machine-discoverable "submit" button in one of them.