what about using a modified version of ssh key authentication? 1. You register your public key on a well known website, the 'identity server' 2. You install a browser plugin (which contains your access data: the 'identity server' and your ID') 3. When you access a confederated website, you are automatically logged in. No captcha, no login form, no forgotten passwords... We don't need to reinvent anything here, it already works with ssh. The public key is stored on the identity server, the private key is on your computer, configured in the browser's plugin.