Ah, but the way the authentication works, you are not actually giving me a Facebook/Twitter password. You actually log in through their systems, and then they let my website know that you are authorized. I never get the password information.

I use the same system used on http://decafsucks.com/login. The authors suggest (perhaps some bias here) that one of the reasons decafsucks.com has had success is they were able to avoid asking for yet another password, and instead piggy-backed on Facebook/Twitter.

Do you think assuring users that I don't get the password (you can see this when you click on one of the login options) is enough, or should I get to work on a separate authentication system?