Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook account?
If the application keys is leaked after the website being hacked, the attacker can act on the permissions authorized by you to the targeted site. Like if you have authorized the site to manage your google drive then they can view your google drive so similar abuse can be carried out with facebook and other oauth compliant websites.
It all depends on how the sites likes Quora, StackExchange, etc. store your keys that are used to authenticate you via Google or Facebook account.
The keys may be stored in plain text or in Cipher text.
Now let us consider that your Quora account got breached.
If the keys are stored in plain text , then your Quora account can be accessed by attacker without any difficulty or hard work.It may then be used to change the password of your Quora account, and other abuse activity. If you are using the same logins for your Facebook/Google account, then these accounts are also breached.
If the keys are hashed(encrypted) by Quora, then the attacker need to use OphCrack like tools to crack(
bruteforce) this rainbow tables.If case if he/she is successful , then your Google/Facebook account is compromised.
To avoid being breached , below are recommendations:
- Never use same password to get authenticated to all the sites.
- Always use
MultiFactor authentication(MFA)where ever possible.
- Please read the