> "If AB is a vulnerability only if B is a vulnerability, then A is not a vulnerability" Stringing together multiple (seemingly) insignificant vulnerabilities

> "If AB is a vulnerability only if B is a vulnerability, then A is not a vulnerability" Stringing together multiple (seemingly) insignificant vulnerabilities to pivot through a system or own a user is hacking 101. I'm not sure how you'd fix this, but given Google's prevalence as an authentication provider, it's definitely not worth being glib about.