If I use Google Sign-In on a questionable site and the site is later breached, could someone get my Google password? What does the site actually receive?
Can a sketchy site get my Google password if I use Google Sign-In?
Asked by
w631+turnkey_8
Answers
With a genuine Google Sign-In flow, Google does not give the site your password or an encrypted copy of it. It gives the site authentication information, including a token, so the site can recognize your account.
A breach could still expose information the site has, such as your name, email address, profile picture, or data you entered on the site. Stolen tokens can also be sensitive, so that is not the same as saying a breach has no consequences.
Reply to this answer
The permissions matter. A basic sign-in may only share profile details, but a site can also ask for access to other Google account data. Read the consent screen before approving it, especially if it asks for access that has nothing to do with what the site does.
Reply to this answer
The sketchy part is the login screen itself. A site could show a fake Google sign-in page and collect whatever password you type into it. Check that the sign-in page is really on Google's domain before entering your credentials. A Google-looking button or page alone is not proof.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Nexby-4t:
So signing in and granting access to other Google services are not necessarily the same thing. Check what the particular app is requesting.