Hopefully someone else will chime in with actual citations, but we've seen a preponderance of evidence from our own user studies, from MailChimp, TechCrunch, and Voo.st's published comments, from Gawker Media's creation of an in-house non-social mechanism shortly after they tried to go social-only, and from private conversations with companies who have daily active user counts well into the millions.

> The proliferation of sites that only or primarily accept social logins seem to suggest that it's not a sound premise.

I'm not sure that necessarily follows. Google's own advertising for G+ authentication touts its privacy features, which suggests that Google also believes that users are uncomfortable with social auth as it exists today.

(Anecdotes aren't data, but they're what I have on hand at the moment. Sorry! Still at PyCon.)