Right, but... I'm not going to do that unless I know what I'm clicking.

That seems like the sort of practice which is fine for normal users, but terrible when your market is developers.

Facebook apps in particular have a bad history of sticking crap in your profile and spamming your friends. I don't mind logging in with Google OpenID because I know it just gives you my name and email address, and that's it.