I've been thinking - let's say a user signs up for your site in the "standard" way. That is, they enter an e-mail address, maybe a user name, and a password, and complete the sign-up process. Is it then, security-wise, reasonable to later allow them to log in using Google authentication?
For example, consider the following flow:
- Usidore signs up with his e-mail address,
- Usidore signs out, and forgets about the site for a while.
- Usidore, not recalling which sign-up method he used, tries to sign in with his Google account that has the e-mail
email@example.com, and is signed in to his original account.
My rationale is that the Google account is (as far as I know) guaranteed to be owned by the person who has access to the e-mail - the user. In case the one who has access to the e-mail is not the user, well... the hacker could perform a password reset anyway, so that shouldn't introduce any additional holes. It might even be more secure than that, thanks to Google's fuzzy anti-hacking logic.
Now, this would probably make it impossible to have
+-es in your e-mail address, as Google uses them for a special purpose while other sites don't. Correct me if I'm wrong, though, and there could be a way to make that work.
In any case - would this be secure? Is there something I'm not considering, and it would not be? Would it perhaps only be secure for Gmail addresses for some reason? Maybe it'd only be secure if the user explicitly links the Google account to the site account (but then again, maybe not; I have no idea). I'd love to know.