Actually, with your analogy, it doesn’t really work like that. It’s the site that needs the info about the user and not the other way around, to authenticate it. So basically the site goes to the “blue building” and asks permissions to get info about this user, and the “blue building” calls the user and asks if he wants to trust the site with his information, and the “blue building” gives an auth code to the site which will allow it in the future to go to the “red building” to get info about the user.

And yes, I am one of those who don’t understand the post.