I agree for the majority of cases. There still exist classes of applications where you can't rely on personal accounts on social sites for auth. Anything that r

I agree for the majority of cases. There still exist classes of applications where you can't rely on personal accounts on social sites for auth. Anything that runs behind your firewall for instance. In my particular case, we run some "enterprise software" on behalf of our customers, whose users regularly don't even have a work email address. Our customers are certainly not going to want users to use their own personal addresses. Most of this can be solved with SAML, but it requires all of these old enterprisey stacks to convert their auth systems to be SAML compatible. In the long term though, I think SAML and OAuth will be more prevalent than using passwords everywhere. Are there any OAuth providers established that simply provide email addresses? I feel there's definitely room for a company to setup an OAuth provider that doesn't do anything except provide identity, rather than relying on personal information harvester companies (FB, Google, etc). The hard part would be getting onto the approved OAuth providers list of all the sites that users want access to.