My favourite is how many sites want you to click on a link in a "verification email" to log in, especially if you take basic precautions like blocking scripts and trackers and deleting cookies periodically. All that work training people not to click links in unexpected emails, and these companies get a bright idea to require that to log in.