I working on a new website and wanted some advice/feedback on OAuth vs OpenID vs Standard site owned username/password.
There is a new standard, called OpenID Connect in developer preview as of November 2011. It is built on OAuth 2.0 and, as far as I understand it, standardizes the way Facebook does things, which is also built on OAuth 2.0. It looks promising as there is a lot of experience with the Facebook authentication protocol, and it could possibly be the solution that many web developers are looking for. I haven't dived into it yet though so I might be misunderstanding it, but this is how I understand it after reading this blog post about it.