Is OAuth hard to implement compared to OpenID? No. Tough compared to plain old stored passwords and auth headers? Definitely.<p>I say this as someone who's using OAuth - because it's The Right Thing To Do For My Users - but any integration with a third-party service involves a lot more logic and state storage than just asking for their account name and password on your own site. Does the code do the right thing if the user doesn't do anything on the screen you redirect them to, closes it but they then refresh your page? Or how about if they decline and the provider doesn't send them back?<p>All the current authentication processes are horrible hacks. Do you really believe that user's check the URL bar if I throw them at a page that looks like Twitter's login one from my OAuth app? How about if I put a look-alike in an iframe within my page?<p>This is something that's really hard to hack on top of the current infrastructure. I'm really hoping something that users understand (or grow to understand) is buildable, but we shouldn't pretend we're in a happy place right now.