What risks are you taking when "signing in with Google"?

Question

(Sorry if this is too basic, I'm not a web dev)

When a third-party web site offers you to "sign in with Google", what risks are you taking: Are you just giving it (the third party) your name and gmail address, or are you giving it anything else just by signing in?

This question is more suitable for security.stackexchange.com/ — Gantendo, May 01 '23 at 05:02
@Gantendo More so than the other 5298 questions here: https://superuser.com/questions/tagged/security ? — MWB, May 01 '23 at 05:08
pretty sure that when that site was started no one wanted to move all the existing questions — Gantendo, May 01 '23 at 05:15
Useful link : How can I block the “Sign in with Google” prompt on websites? — harrymc, May 01 '23 at 09:06
This is not a bad question, but it is not a good fit here. To be fully explored this needs discussion, back and forth, multiple viewpoints, because it comes down to lots of data points and then a judgement call by each person. To be best answered this question needs a forum, rather than this QA site. Not a bad question, just this is not the right place for it to be fully explored. — music2myear, May 01 '23 at 16:36
@MWB: Questions related to security and computer hardware / operating system remain on-topic here, even if they would also be on-topic at security.stackexchange.com. But your question relates (only) to websites, and therefore it is off-topic here. — Ben Voigt, May 01 '23 at 18:28
Related Is authentication using Facebook/Google considered good practice?, Google Accounts login - is it good enough for financial services?, Why don't some services offer Google/Facebook/Apple/Twitter login — Wicket, May 01 '23 at 21:47

score 7 · Answer 1 · answered May 01 '23 at 15:32

7

As @Tetsujin mentions, you share personal data with Google they would not otherwise have. You also share with the other account information from Google that they would not otherwise have.

Another risk is that you have inserted a dependency of requiring that particular Google account to access and use your other account. You lose access to your other account if you lose access to your Google account, or the other account stops supporting Google sign-in, or if Google drops that other service due to legal / political / other issues.

If your Google account gets hacked or breached, you put the other account at risk.

If you use sign in with Google on a lot of other accounts, you have a pretty large single point of failure.

answered May 01 '23 at 15:32

pseudon

363

1

Many of these risks would also seem to apply if I create a separate account on that website and enter a Gmail address there. Then too I am telling Google I am registering on that website (because they send me a confirmation email), anyone with access to my Google account can reset the password, and I lose access to my account if I forget the password and no longer have access to my Google account. Am I mistaken in any of these points? – wonderbear May 01 '23 at 17:50
1

@wonderbear: Note that "if I forget the password and no longer have access to my Google account" is now two faults; it is "single fault tolerant". Whereas "login with Google" has a single point of failure. – Ben Voigt May 01 '23 at 18:26
If you register with a Gmail address, Google only gets sender, subject, or contents if they scrape your emails, something they claim not to do for ads / personalization. – pseudon May 01 '23 at 23:15

score 4 · Accepted Answer · answered May 01 '23 at 04:56

4

When you click on that button, it will redirect to Google's sign in page, and once you sign in, Google should show you what information of your Google account is shared. Some websites might also allow you to enable/disable the sharing of certain info.

Most social media apps should just need name, email, avatar. Other apps might need more depending on what they do/want.

answered May 01 '23 at 04:56

charlesz

311

Strange. I just did it, but I didn't see any permissions menu. – MWB May 01 '23 at 07:07
"When you click on that button, it will redirect to Google's sign in page" is how it is supposed to work. However you as the website visitor have very little recourse if the webpage spoofs the sign-in page instead of using the genuine Google one. – Ben Voigt May 01 '23 at 14:11
@BenVoigt You can check the URL. – charlesz May 01 '23 at 17:29

Tetsujin · Answer 3 · 2023-05-01T16:54:09.633

3

I would consider the main 'risk' being that by using the service, you are contributing your personal 'interest list' to an organisation whose entire raison d'être is to sell targeted advertising to 3rd parties.

I would see that as sufficient reason to never use this type of service.

edited May 01 '23 at 16:54

answered May 01 '23 at 06:29

Tetsujin

49,589

1

It is 'a' risk but not the most severe one. – Ben Voigt May 01 '23 at 14:12
Google sells targeted ads, obviously. But I'm assuming that it's all anonymized. – MWB May 01 '23 at 23:11

What risks are you taking when "signing in with Google"?

3 Answers3