Two things: First off, having multiple login systems doesn't necessarily enable you to honeypot credentials off of people that wouldn't otherwise give them. Th

Two things: First off, having multiple login systems doesn't necessarily enable you to honeypot credentials off of people that wouldn't otherwise give them. The people using Facebook credentials to try to log into a site with Facebook Connect is probably going to reuse the same username and password when they register for your site. People who don't understand security are completely terrible at password reuse discipline. Second, the solution to this requires a collaborative effort from both the auth provider and consumer. If I sign into Facebook and check "This is a public computer", then Facebook should remember that. Then, Facebook should provide a "finishSession" API call or whatnot, which a site calls when the user logs out. This lets Facebook determine what to do with the user's facebook.com cookies - if it's a transient session, wipe them. If it's a persistent session, don't do anything with them. OAuth clients shouldn't have to care about the semantics of the Facebook login - just like authentication is delegated, so should management of the user's session be delegated. This would preserve user expectations in both cases.