OpenID: If they have a yahoo account, the user just has to remember "yahoo.com" and if you're supporting OpenID 2.0, it'll work. If they have almost any kind o

OpenID: If they have a yahoo account, the user just has to remember "yahoo.com" and if you're supporting OpenID 2.0, it'll work. If they have almost any kind of blog or social networking profile these days, it's also an OpenID. Users remember their OpenIDs. Use the discovery mechanisms built into the spec to do the hard part for them. Check out the RESTful apis being built as part of the OpenSocial specification. If they can tell you what network they're a part of that supports OpenSocial (Google, MySpace, hi5, Plaxo, and soon, Yahoo) then you'll be able to kick off an OAuth process that ends in them giving you permission to fetch their friendlist. But their email username and password? Don't ever do it. We're past that stage now. It's no longer state of the art, and it's dangerous enough that it ought to be considered harmful by all responsible adults.