racbart

Nothing poses a single point of failure unless one uses it that way.

If you add other identity providers then sure, you're less vulnerable - just like if you replicate your database and set up failover. There are many ways to avoid certain SPOFs but possibility to fix doesn't make a SPOF stop being a SPOF. It's all about how you use them.

If you use FB Connect as the only way to sign into some of your accounts then FB Connect becomes a single point of failure for these accounts, period. That's what happened to Om. There might be only 30% of his accounts affected, but for these 30% accounts, FB Connect was a SPOF.

For me it's easier to use old-fashioned login/email+password signup with a password manager like 1Password than signing up with multiple online identities to every new account (who does that anyway and many websites allow you connect only one identity). Classic email+password has a failover by default in its design - if I forget my password I can reset it by email (I need both to forget password and have broken email at the same time to don't be able to login).

Anyone with some IT background should be familiar with a single point of failure concept. This is why I personally don't use FB Connect, OpenID, etc. If anything goes wrong with your single global login process, you're in trouble. It doesn't matter whether it was your fault or your provider's.

When I create web products, I don't hesitate that much. If people want it and if it can increase signup conversion, then let's roll with it. But I don't use that as an user. A good password manager is more than enough for quick and convenient logging in.