If the repositories contain a site which requires authentication, and access to that site is denied, then the first refresh will hang at Waiting for Authentication.
Access to that repository should time out, and a warning be issued showing the failed repository. The repository should be blacklisted until the next refresh.
If the repository is subsequently deleted from the repository list, the same result occurs.
Refresh should delete the databases and restart from scratch if there have been blacklisted repositories.
Using Version 0.63 on Mandriva 2010.1 (urmpi) x86-64
All the best
We moved the upstream bugtracker to GitHub a long time ago. If this issue still affects you please re-create the issue here: https://github.com/hughsie/PackageKit/issues
Sorry for the impersonal message, and fingers crossed your issue no longer happens. Thanks.