yeah its confusing as all heck to users. The ONLY possible upside I can see, is that it slightly reduces the risk that they give the crown jewels (say, their G

yeah its confusing as all heck to users. The ONLY possible upside I can see, is that it slightly reduces the risk that they give the crown jewels (say, their Google User name and password) to some malicious site mistaking it for an open ID log in. In other words, the fact that the identity is the web site is a feature. It may not be the right feature, but I think there is some design thought behind it being a url. So users get used to not immediately providing a password, but instead this URL, and THEN after some redirect shenanigans, they do their password etc...