I have implemented Google login (OAuth2) login on my website. It matches users by e-mail, i.e. if your e-mail is the same in Google as in our system, and you have Google Auth enabled on my website, you are logged in.
Should I enable it for everyone by default? I want to do it on the assumption someone controls Google account, they control the associated e-mail account, and therefore they already have access to the user account on my website (since I implement password reset by e-mail).
Are there any security implications that I should be aware of?