Secure login?

[eluser]Aquillyne[/eluser]
Take Google's login to GMail. I bet it isn't particularly simple.

I think there is more meat to my question of how to make a secure login than you suggest.

And then im obviously interested in what would be the best CI way of hashing out that logic.

For instance, it seems prudent to lock someone out after they've tried logging in too many times. Just how might I achieve this in a good way? A bad way might for instance be to store a cookie on their computer. They could then just clear their cookies and start again with their login attempts.