Although we think using Twitter or OAuth is the easiest way. 1 Auth and your email address, thats it.
Thanks for your feedback.
One other thing you're missing is that as a new user of your thing, I don't trust you enough to hand across my twitter username or openID. I'm more than happy to create a throwaway account with you, but you're certainly not going to get any information that links my profile with you with my profiles elsewhere.
In short, you're losing a significant fraction of your potential userbase. Right now, since this is the moment when you've got more exposure than you'll ever have again. Spend 20 minutes getting a user/pass thing implemented right now, before the sun comes up in the US, and you'll quadruple your first-day signups.
1) When you authenticate with Twitter or OpenID its all done on Twitter or your OpenID providers site. We cant snoop your credentials at all, you dont enter it on our site. 2) Sure authentication is an easy feature but this way we dont need to ask you for your details again, you let us talk to your service and use your existing information. 3) You can kick us off from your Twitter account from Twitter itself and at any time, see Connections section under settings.
Some people might be conscious about us being able to access your Twitter or OpenID information but its mostly available to the world on these services anyway. OAuth (which is the underlying technology behind this authentication) is being used more and more. It's much better and safer for end users, its just that initial hurdle to get mass adoption. Its the end users decision if they trust the site or not. Most people have trusted us today :)
We cant make any changes to the app whilst its being judged, not one line of code. I do agree that we should look at implementing a base user signup sans-OAuth provider but we cant do anything until Rails Rumble has been judged and voted. It was a 48 hour coding competition with many other developers around the world, see www.railsrumble.com
So when you say "Give me your Twitter username and password", they'll say no. It doesn't matter that it's actually safe. It certainly doesn't sound safe, and that's all that matters.
Argue against it at your own peril. People are comfortable with user/pass.
You're comfortable with new user/pass and it doesn't sound safe to you.
Lots of sites use Facebook Connect because it actually drives signups.
Where are you basing your argument that people do not actually want to give their twitter username and password?
In my experience, a lot of casual users do not actually care. We had an email inviter that was used frequently where people actually have to give out their Gmail/Yahoo/Hotmail credentials.
You may be comfortable with user/pass but do not make the assumption that the rest of the world are. You may think you're mainstream but you're probably not.
Give them the benefit of the doubt that it makes more sense for them to do this than an email/password authentication.
I don't think they are trying a big push for their site right now so they just need to do enough to make it work.