There are several options going beyond username/email/password as most sites do. You can't solve the ultimate security issue, but you can educate. There are alternatives to captchas. Security vs ease of use is a never-ending, healthy debate.
Extra security options during login
Yahoo! uses the "sign in seal" concept, where you can choose either some text or an image, and that customisation will be stored in a cookie and displayed on the sign in page when you return. The idea here is that it helps prevent phishing attacks: instead of explaining the technical details of phishing to users, and expecting them to remember things like "make sure the url starts with https://www.yahoo.com", you just tell the user to look for their customised text or image on the page. If it's not there, you're not at the right site, so don't supply your login credentials.
World of Warcraft uses the Blizzard Authenticator, which is either a device you can order and have shipped to you, or an iPhone/Android app. Both generate a unique code tied to your account every minute. When you log in, you need to provide your Battle.net registered email address, account password, and that Blizzard Authenticator code. Although it's a game, World of Warcraft is a phishing continent of its own, this approach has proved extremely effective in reducing the number of hacked accounts through phishing (since even if you hack into someone's email account and retrieve or change their World of Warcraft password, you can't log in unless you have that actual specific synched Authenticator code). It's worth noting that the Authenticator is theoretically hackable, but it takes much more work to do so.
myOpenID uses a similar sign in seal to Yahoo! called "your personal icon". Since OpenID has additional security implications (eg. if you gain access to my OpenID, you now potentially have access to all the sites I use with that OpenID), any options towards increased protection helps a lot. I don't think most nontechnical users have OpenID accounts with OpenID providers, however, so this might be less of a big deal. Still, good on JanRain for going the extra mile.
What to do when users provide obvious security questions and answers
This is a problem you can't solve, and it's not really your responsibility. What you should focus on is promoting the right behaviour in your users by educating them on what they need to pay attention to. Depending on the type of userbase you have, you can be more or less aggressive about it - for instance, Yahoo! and Blizzard are very aggressive and also implement more proactive security assistance, as mentioned above.
Some things you can do:
- Remind users to use a unique password consisting of not only alphanumerical characters
- Explain that passwords should be made from non-existent words, and help explain how to create a memorable password that fits that mold
- Use clear copy during the flow where users create a security password reset question and underline the importance of asking non-trivial questions that other people won't know the answer to
- Provide examples of questions that people could use (don't provide examples like "mother's maiden name", which is easily found via Facebook these days)
- Write a FAQ providing tips on how to secure your account. Since webmail is an oft-used security hole, provide basic tips on securing your email account and how to watch for phishing attempts
Be a responsible website proprietor. I liken it to train stations that have signs up saying "watch out for pickpockets" - it's your responsibility as an individual not to have your wallet in clear view and then complain when it gets stolen. But it's nice of the station management to remind people to keep things in mind. The problem on the Web is that many people don't know what to look out for or how to identify threats. We can help by constantly, consistently educating everyone we come into contact with.
Captchas and alternatives
Captchas exist for two reasons: one, to prevent your site from getting DDOSed and two, to prevent hackers from executing dictionary attacks. But the downside is that, in most cases, they're very unfriendly and completely not "Don't Make Me Think".
If you want to prevent, or at least dissuade, dictionary attacks, consider adding a timer to the login screen that increases for every attempt (after a certain number). Most users will get in after, say, 5 attempts, and any more than that is dubious behaviour. Make dictionary attacks annoying to execute on by causing problems for offenders, not regular users.
Security vs. ease of use
Jakob Nielsen caused a splash last year when he wrote that password fields present a usability problem and should stop masking their input. He argued that masking the input only really prevents security leaks when someone is standing directly behind you, and that's not the case 99% of the time, so why make things harder to use just for an edge case? As a usability expert, it's hard to argue with him. And security expert Bruce Schneier even agreed with him!
So security vs. ease of use is a controversial issue that can't really be resolved. And it's a healthy argument: if things swayed too far in either direction, that wouldn't be good for end users. As a UI designer, it's important to recognise security experts' arguments, and take those into account when designing your user's experience.