I'm generally allergic to "let the Big 5 run your services", but I have to admit that "sign in with Google" looks like a major improvement on "hand PII to whoev

I'm generally allergic to "let the Big 5 run your services", but I have to admit that "sign in with Google" looks like a major improvement on "hand PII to whoever tried to home-roll auth". With a password manager and careful shepherding of your PII, maybe there's not much risk; if someone takes over the site your account is compromised either way, and nothing else is lost. But most people don't actually use password managers, and lots of sites that accept Google sign-in require lots more data to actually create an account on the site. (Plus, losing password stores is not necessarily the same as losing all control.) Newbies storing creds is a perennial source of leaked credentials that get used to attack more important sites.