Assume my solution offers 5 identity providers that users can choose from
Apple Facebook Github Google Microsoft
These providers all take user identity very seriously. Is there any legitimate liability concern that an unauthorized person might be able to authenticate themselves with the same email but with a different identity provider?
The logged in user would have access to their own sensitive personal information and some small funds (worth < $100).
I assume that if that happens, that user's email account must have been compromised, so we can't be liable for that. If one of the auth provider companies was compromised without disclosing it, or allowed people to commit unauthenticated identity fraud, it would be recklessness on their part - and we could help the user recover damages that way.
I'm thinking that the most user friendly approach would be to allow a user to disable "untrusted" auth providers (e.g. a user doesn't trust microsoft, so they can choose to disable microsoft and github sso access), and maybe notify them when their account has been accessed from a new auth provider (although that would go to the compromised email anyways, so is there really a point to that?)
Is there something I'm missing or would that represent sound and reasonable security practice?
related, but doesn't have a concrete answer: Is it safe to rely on email address from 3rd party identity provider?