Scippy,
Yes, that is correct. A little additional setup would need to be implemented on the non-DNN site but in general that is how the module would or could be used -- have it pass the username/password to the DNN site. It does not go from the DNN site to external sites but the other way around: from external sites to DNN.
I'm currently working on some enhancements to allow an external site to request a public key to encrypt the credentials and pass back to the DNN site in a login string for enhanced security as well as a few other enhancements. No release date on that yet.
If you are looking for something that goes *from* DNN to an external site I have built something like that at my day job and could retrofit it to work in the "real world" but I find it less and less useful as other sites build in enhanced security to prevent cross-site posting, etc, on the login forms.
Thanks,
Jon Seeley