@Robert Charlton
This refers to a concept called federated identity sometimes referred to as SSO (single sign on) but I think the concepts are slightly different.
[
en.wikipedia.org...]
"By signing up for an account on our site you agree to give Google your password" might be a tough sell....
You should never "give" your password to any website. Passwords must be stored in the database hashed and salted such that it is impossible for anyone to see the stored passwords in plain text. The problem is that once you press submit on the sign-in form you have no idea how the data is handled. You simply can't know how every website is handling your credentials, but you can be pretty certain that Google is doing it as securely as possible and so using such a service provides a degree of trust and confidence for the user that cannot be had any other way. Not to mention that many people already have gmail accounts, so Google already has their credentials, thus there is no need to provide this data to others that risk misusing the data or being hacked.
This service are also offered by others, such as Facebook, possibly Twitter and Linked In, to name a few.
The real trust issue lies between the website and Google. Most directly, one needs to trust that the account has not be compromised and that Google (or any other provider) isn't authenticating user that shouldn't be, but here again it pretty safe to assume that Google will do a good job with this. Indirectly, each login to your website is logged by Google, thus providing them with yet more usage data. But really the biggest "trust" risk is that Google can for whatever reason decide to cutoff your account (as website using this service). As result, you will not only loose the ability to use the service but you will also loose any users that are signing with the service.
Ideally, one would need to develop a decentralized system, using blockchain technology, allowing users to store their credentials on a blockchain and then allowing the user to grant or revoke access to specific websites without ever providing their data directly to the website or app. With such a system no central party could control the data, and all parties (websites,apps and users) could interact without needing to trust each other directly (trustless). I believe that there are projects in development.
but I"m thinking that this has got to be more like secure https... that some mutually agreed upon mutually agreed-upon identifier be used which neither party possesses alone...
Typically these services use JWT tokens, which work very much like https.
[
jwt.io...]
Also there is more information here about OAuth and OpenID (another standard).
[
cheatsheetseries.owasp.org...]
As for the announcement by Google, "signin with Google" has been around for a long time, the one tap option seems to be the new feature, mostly UI from what I could gather but it looks interesting.
