Without something like u2f on the originating service, I could see this attack. Never thought about it, eeek. Let's say you were Google and to "help" people, y

Without something like u2f on the originating service, I could see this attack. Never thought about it, eeek. Let's say you were Google and to "help" people, you were going to "login on their behalf" to "index and organize" their info. No need to obtain consent, just fake a login and scrape away. The rest of us can replace with quoted words with 'exploit', 'hack', and 'sell their personal info on the market to the highest bidder' but when Google does it, its ok.