@NathanBowers my point is that even if EVERY site was compromised, with OpenID / OAuth 2 they'd have nothing. zilch. nada.