oauth2 account authentication

Question

imagine you secured your application with oauth2 and several oauth providers.

Now imagine someone using provider A with email bob@example.com to log in.

Next time, someone uses provider B with the same email bob@xample.com to log in.

Both provider state that the email address is verified and both are big companies (no way to specify you own provider or something like this).

Should you map both logins to the same account? What are the risks?

The risks I already see are that the attack surface is getting bigger: if I want to hack the account of Bob, I can try to hack provider A or B. But the benefit would be more convenience for Bob, since he will not have to remember which provider he used...

Answer 1

First of all insure that each OAuth provider actually verifies the users email address. Google and Facebook do this, but not every site will verify your email address (reddit is an example). Google and Facebook are on the ball when it comes to security, and I doubt they will be the weakest link. However, defense in depth is admirable quality.

A simple solution to the problem of using the email address as the unique identifier is to email the user and ask them to click on a link which confirms that both OAuth providers should be linked.