I second (or rather fifth, sixth, seventh) those who’ve pointed out KeePass (or its ilk) as a perfectly reasonable, safe, secure option for managing one’s passwords. The model’s a great one: I own the app, I own the password file (which is itself password-protected – symbolically analogous to my OpenID url), and it creates excellent, strong passwords for me – all I have to do is open, find, copy-paste, and I’m golden. It’s not one click, but it’s rarely more than a few. KeePass, essentially, is OpenID, only it’s in my pocket, behind my firewall, and physically locked up in my house, rather than floating “out there” in the cloud somewhere, waiting to be compromised.
Identity services like OpenID don’t seem to solve much of a problem, then. As users, we already have the option of using one username and password for everything. Better we don’t, of course – better (IMO, though it seems pretty obvious) that we keep our identities more, rather than less, fragmented, and hence more secure, if only for there being so many more locks to negotiate.
As such an obvious