There have been some complaints that the big sites want to be providers of identity but don’t want to accept identity from smaller sites. I happen to think that’s (mostly) OK for right now but also constitutes an opportunity (see second paragraph). To become trusted providers of identity the large sites (Facebook, Google, Yahoo, Amazon?, eBay? et al) will have to make significant investments in monitoring and administration. Spammers and others will spend a lot of time trying to create fake accounts at large identity providers and it will be an arms race of epic proportions to keep them at bay. Small sites are extremely unlikely to be able to muster the necessary resources. On the other hand small sites have a ton to gain from accepting identity from large providers. I have not seen any stats yet but I am convinced that offering Facebook Connect as an option will significantly increase a site’s conversion rate from browsers to registered users.
There is one way that might make sense for smaller sites to be able to become providers of identity is if they can create a network. It would be possible to create something that uses email hashes (like Facebook Connect) to tie together profiles across many smaller sites. Ultimately such a system could be more robust against impostors because each site could provide some activity information which would make it harder to create fake accounts. In order to make that happen and make use of the data, I believe there would have to be a centralized provider that operates the network. The challenges for such a provider are how to get started and also what the ultimate business model might be.
