I think we really need something like this. I wanted to use the perl.org authentication system for AnnoCPAN, but it wasn't ready yet for use by non-perl.org sites and I couldn't wait any longer. ;-) (but they are working on it)

It is possible to have a reasonably secure system where the password database is held by a central server and the other application servers don't know the user's passwords. That can be done by having the authentication server create a signed cookie that is passed to the application servers by the user as a form parameter. The main weakness is that if the central auth server is down, no one can log in to any of the application servers...

However, I find the idea of having an application server (such as cpanforum.com) receive the user's password for another site (such as perlmonks.org) and then use it to authenticate the user in permonks.org very, very bad from a security point of view. How do you expect every user to trust you with their perlmonks.org password?