I am seriously considering disallowing OAuth in my apps for a few reasons:
1. It would be impossible for the user to voluntarily give up rights to information they may not understand.
2. It would be impossible for the app to act on behalf of a user.
3. True early adopters are not deterred by the lack of quick sign-in if they truly love the product.
4. Signing up with email is easy today, and browsers make logging in an automatic and smooth process.
5. Emails already act as zero-permission identities.
For me, emails are the root of my internet activity. Everything I do is tethered to email, not Facebook or Twitter. Going to my email to click a verification link is trivial and takes a few seconds; well designed email-verification can be seamless. It might even take me
more time to read and grok all of the permissions the app is asking for.
Furthermore, I don't have to worry about having a user account system that has to be ready to deal with N different OAuth tokens. Personally, I have found OAuth to be a very inelegant technology.
Next time I build a website that has accounts, I will try and market the lack of "signing in with Facebook" as a boon to the user. OAuth is a slippery tool for collusion, something I never want my customers to be victims of. I cannot advocate for technology that is primarily used to extract information from passive people.
Making the rules so hard to read that the average person just says "yes" was unethical in 1492, and it's unethical now.