Not an OpenID pitfall, but shoddy HTML parsing.

"Unfortunately, Facebook Connect then screws up. The whole point of delegated auth is that we stop users entering their passwords into third party sites. It has to stop. That means both actually entering their details into third parties, but also interface that gives the impression of giving your password to a third party." Indeed, this crap is getting old.

"Windows CardSpace is a Microsoft .NET Framework version 3.0 component that provides the consistent user experience required by the identity metasystem. It is specifically hardened against tampering and spoofing to protect the end user's digital identities and maintain end-user control."

Collecting instances of openId login screens