It's funny I used to love SSO/Authn technology 5+ years ago, I wanted every site to have it, because I didn't understand the downside or even appreciate that there could be a downside.
Now I almost always create a new, fresh U/PW, and I'm annoyed by sites that don't have that option.
There are really some positive upsides to bring your own identity / SSO / global authn / etc. Almost always more secure, usually fewer touchpoints in the case of a leak/hack (almost all SSO implementations don't actually share critical details with the downstream site, they just send a random token authorizing your login), enables technology like passwordless login, easy to manage in one place, etc. Downsides are around potential for abuse, privacy sharing details, ad tracking, accidentally sharing information you don't want to share.
There is an interesting phishing example that I read about to trick people into thinking they're logging in with google, but it's pretty sophisticated... Of course I read about it on some feed and now it's totally lost to me, but it amounted to spoofing a site and then launching a completely fake login window where you replicate the browser UI to make it look like you're authenticating through a secure site, when it's all spoofed with styles. Clever.
arstechnica.com
