While I have my issues with OAuth, I think it depends on the use case more than anything. For example, I have written a custom ticket system for my current comp

While I have my issues with OAuth, I think it depends on the use case more than anything. For example, I have written a custom ticket system for my current company, and since they have drank the google coolaid, everyone has a google apps account, so using OAuth2 to provide an easy login that doesn't require the often clueless users to remember yet another password. (working on pushing pass management, yubico integration and other two factor). It was simple to implement, gives me information that is helpful (the person who submits the ticket doesn't have to tell me who they are, I already know.), and just works. On the other hand though, I have two side projects at the moment. A reddit/hn-esque news site dedicated to logical analysis of stories, and an Unreal Engine 4 FPSRPG game. For the game, I really want to encourage good security, both for accounts (the game website accounts) and for game login (game login accounts). Looking at the issues that the major MMO providers ran into, and for example, Blizzard finally come out with the Battle.net authenticator, but adoption was fairly low, but the important part is for the people who valued their account greatly, it was often worth the overhead. Besides that though, there was just a simple in-house auth. I don't think anyone would want OAuth to login to an MMO, so there it's not even an option. The alternative I have thought of is instead of a physical dongle authenticator, having some sort of two factor built into the login portal. While it doesn't offer the same protection as a dongle, it would be more than the simple user/pass combo to help reduce compromised accounts. For my news site on the otherhand, I am struggling to decide what kind of logins to allow/seek. Since it would be a social type of site, OAuth could be useful for people who want an account but don't want to sign up for yet another thing. As a privacy conscious person though, it raises lots of privacy and user identity concerns. Reddit free-for-all style user-creation though seems to be too apt to be abused in all kinds of ways, but then HN has a similar system but then prevents that with restrictions on top. (which I think would falter under the same user-load as reddit). In the end I think the free-for-all is probably inevitable, especially if I want to allow tor connections, and restrictions will, like hn, have to be placed on top. A lot of that is design related. Stories would be wikipedia-esque in that some users could edit, and comments would be a separate section, and I think that's where slashdot style random mods and perhaps user points over time would give good commenting users ability to then do edits... I still haven't ironed all that out yet. The bottom line is that it's all about use case. And while OAuth isn't perfect, sometimes it works just fine, and in others it won't. Use the right tool for the job.