Trust would be an issue. In an open system, it would always be possible to set up a rogue server with spoofed profiles. There are ways to combat this. Using OA

Trust would be an issue. In an open system, it would always be possible to set up a rogue server with spoofed profiles. There are ways to combat this. Using OAuth for authentication keeps them from getting your credentials. It or a similar protocol for data exchange allows you to shut them off if they're proven bogus. They might have limited visibility into your network in the meantime, but that's it. It will probably end up working a lot like the web works now. You'll have to look at the URL and decide if you trust the provider. You can also send a message along with the friend invite and prior to accepting another's invite, that gives you some confidence that you know that person. Finally, by seeing that you share common friends on common providers will be a strong indicator.