Ok, so browser phishing protection should prevent a hostile site from being able to fake this work flow then, right? In that case I guess I can live with it.

Ok, so browser phishing protection should prevent a hostile site from being able to fake this work flow then, right? In that case I guess I can live with it. I'll just have to go to the effort of setting up my own openID provider since I still don't want different sites tying my ID together so I'll have to set something up on my side. This is all a lot more effort than it was before and I don't see any benefit at all to how I use the internet. But thanks for giving a detailed explanation of how it works. At least my security concerns are lessened (still, compromising one site and logging passwords will compromise every site you use this service with).