Password should not be displayed; replace each character, as it's entered (KeyPress event), with one or more "*".
Allow only a few attempts to login, then abort the program.
Keep track of those logged in, the PC, and when, when off on a multi-user system.