Facebook – Allow Facebook, Google, etc. (OpenID) login to the WordPress.com hosted private blog

Check (and keep checking) the privacy settings on your account.

On this page: http://www.facebook.com/settings/?tab=privacy

Make sure that you only allow friends to see your data.

On this page: http://www.facebook.com/settings/?tab=privacy&section=apps

There's a "Public search" option - make sure that's set to disallow.

There's a option for "Information accessible through your friends" make sure that you clear all the check boxes on that dialog.

There's an "Instant personalisation" page - not available for all users as yet - but when it does become available make sure you clear that option too.

On this page: http://www.facebook.com/editaccount.php?ads

There are options for Facebook ads to use your data - clear both options.

You have to keep checking because Facebook regularly change the options and the defaults are to be more open than you would like.

Ultimately you are joining a site whose premise is the sharing of information. If you're not happy about sharing something - don't post it to the site, either directly or as a link. If you're not happy about sharing anything - then don't sign up!

To answer your points using the same numbering scheme:

1. All Google should share is that fact that you are you. The 3^rd party site is asking Google "is this person who he claims to be?". Google should answer "yes" or "no". No further identity information is needed nor should it be provided without an explicit request.

2. No site should know (or indeed need to know) what other sites you are logged into with your Google Id. Sites should be asking you if they can find out this sort of information - even if sites "B", "C" and "D" publish this sort of information anyway.

3. This will depend on the site. Your account should be independent of the authorisation method.

Notice that there are a lot of "should"s in this answer. You may find that some unscrupulous sites try to get this information and others are loose in what they publish for others.

If you have any particular concerns it would be better to contact either Google (the identity provider) and/or the site (the identity consumer) directly.