I don't understand most of the arguments centering around "single point of failure." Part of the problem is that the terminology is misleading. You can, in fac

I don't understand most of the arguments centering around "single point of failure." Part of the problem is that the terminology is misleading. You can, in fact, have multiple "single points of failure". A better term is "central point of failure". Your email account is a central point of failure -- once it is compromised, an energetic black hat can use "forgotten password" links all over the web to compromise many other things. (Assuming that your usernames are guessable, which they often are.) If you only have one central point of failure, it's also a "single" point of failure. Unfortunately, once you link a bunch of logins to your OpenID provider it becomes a second central point of failure. The black hat can compromise a slew of accounts by either getting your OpenID password or your email password. Now, at some point, mud is mud, and you can't make it muddier by dumping mud on it. And, at some point, insecure is insecure, so it really may be silly to object to OpenID on central-point-of-failure grounds, because you've already got an even bigger problem with email. But I think it depends on the details. And, at best, you're playing for a tie: "OpenID -- at least as secure as the insecure thing you're using now." is not a great rallying cry.