Here's how I had hoped that OpenID was going to work, when I first heard about it, but did not know many details. Initial conditions: I have an account at some OpenID provider, and I do not have accounts at Hacker News, Reddit, or StackOverflow, and all three of these take OpenID.

1. I decide to sign up for HN. I enter the URL of my OpenID provider. HN sends me to my OpenID provider, along with something that uniquely identifies HN.

2. I authenticate to my OpenID provider. It tells me I have not associated an ID with HN yet. I tell it to create a new one. It creates an ID for me, which I can name for my convenience, and it assigns a UUID to that ID, say 5F29ADF6-132A-43D0-889E-AD38A48D2419.

3. I'm returned to HN, and HN is given that UUID, 5F29ADF6-132A-43D0-889E-AD38A48D2419, and told that I've been authenticated. HN sees there is no HN account associated with that, and lets me create one. I get to pick a name to use on HN. I pick "tzs". HN remembers that "tzs" is associated with 5F29ADF6-132A-43D0-889E-AD38A48D2419.

4. Next time I come to HN, assuming my cookies have been deleted so I need to login again, the steps are similar. I tell HN my OpenID provider and go authenticate there. It sees that I already have associated 5F29ADF6-132A-43D0-889E-AD38A48D2419 with HN, so provides a one click way to send that ID to HN.

5. Now I decide to sign up at SO. Similar to signing up at HN. When the OpenID provider says I have no identity associated with SO, I tell it use the same identity I use with HN, so 5F29ADF6-132A-43D0-889E-AD38A48D2419 gets sent to SO. I create my account there, again getting the name "tzs".

6. Finally, I sign up for Reddit. I decide I'll probably not be able to refrain from staying out of the technical groups there, and will end up in the politics groups, and will probably make a lot of enemies. I think I want to keep that identity separate from my more professional/respectable personas at HN and SO, so I have my OpenID provider generate a new UUID for use with Reddit: DE982C60-3164-4399-B8E5-C9F84FCE2B21.

7. With each identity I can associate personal information, if I wish, such as real name, address, phone number, email address, even credit card information if I dare. When a site sends me to OpenID to login, it can send a list of what personal information it would like. At my OpenID provider, it shows me what is being asked for, and I can decide what actually gets sent. It would have a reasonable system for managing defaults to make this unobtrusive most of the time.

With this kind of OpenID, I can easily solve the problem that is most important to me: having one good password to control access to a bunch of sites, without having to actually give that password to the sites. It is up to me if I want to use the same identity on multiple sites or not. It is up to me how much information for an identity I wish to share.

(The low level details in the above are simplified to get the ideas across. In a real implementation, there would be some kind of public/private key system involved to identify the user, rather than a simple UUID system, so that one could reasonably implement a way to let someone move their identities to a different OpenID provider without having to have HN, SO, and so on all update things on their end to recognize the new provider).