Is it reasonable to allow Google sign-in for people who signed up "normally"?

Question

I've been thinking - let's say a user signs up for your site in the "standard" way. That is, they enter an e-mail address, maybe a user name, and a password, and complete the sign-up process. Is it then, security-wise, reasonable to later allow them to log in using Google authentication?

For example, consider the following flow:

1. Usidore signs up with his e-mail address, [email protected]
2. Usidore signs out, and forgets about the site for a while.
3. Usidore, not recalling which sign-up method he used, tries to sign in with his Google account that has the e-mail [email protected], and is signed in to his original account.

My rationale is that the Google account is (as far as I know) guaranteed to be owned by the person who has access to the e-mail - the user. In case the one who has access to the e-mail is not the user, well... the hacker could perform a password reset anyway, so that shouldn't introduce any additional holes. It might even be more secure than that, thanks to Google's fuzzy anti-hacking logic.

Now, this would probably make it impossible to have +-es in your e-mail address, as Google uses them for a special purpose while other sites don't. Correct me if I'm wrong, though, and there could be a way to make that work.

In any case - would this be secure? Is there something I'm not considering, and it would not be? Would it perhaps only be secure for Gmail addresses for some reason? Maybe it'd only be secure if the user explicitly links the Google account to the site account (but then again, maybe not; I have no idea). I'd love to know.

Answer 1

Yes, many websites do allow this by allowing you to link a local account with the Google Account. You should send email to the old account's email address, requiring a confirmation click/code from that email, rather than requiring/assuming the same email. Security wise, this is no different than a password reset via email.

Next is that you can allow user to optionally disable local authentication and just use Google Account authentication. Give the user the option, as some users may want to sign in to your site using shared/public machines without having to authenticate to their email account so local authentication can still be useful in this case.

When a user is signing up for a new account, you can notify the user that that there is already an account with the same email with a different authentication method. You can then prompt them to sign in or reset the password on the old account to link the account to the new authentication method. For new users, they should also be allowed to create an account with just Google Account authentication, without creating local authentication.

Answer 2

I think the more login options, more hacking possibilities. If the user only has one way for login, it can be hacked, but if has two possibilites of login, now there are two possibilities to be hacked, the normal way and the google account which has another different password.

You are right to think that Google has good anti-hacking mechanisms... but you never know. Maybe the user can be hacked on LAN, sniffed or sslstripped or who knows.

In my opinion, login with standard user/password validated by mail is enough. But to put the Google login option maybe is more because other reasons different than security.