Regarding denial of service, does that not apply to any identity provider? OAuth, Facebook/Twitter sign in, all suffer the same problem. Perhaps I have too much

Regarding denial of service, does that not apply to any identity provider? OAuth, Facebook/Twitter sign in, all suffer the same problem. Perhaps I have too much faith in their systems, but I don't imagine downtime occurring in reality. You are correct in assuming you can't use your hotmail address when Gmail is inaccessible, unless it was planned beforehand. As in, you can auth a second identity provider for the same account - which would be possible, but not as an afterthought - so probably useless. I guess a careful read of their T&C's is a good idea, but what would you envisage as warning signals? Spyware, well, if users signed up using gmail, google would know. That's most users anyway these days. But you're right, in using google analytics I'm providing them all this information anyway, so perhaps I'm less concerned. Personally, I think the benefits outweigh the problems you've raised, but perhaps I'm being an optimist. If something did happen down the line, I would have to issue all users with a new password down the line, that would be frustrating, but not the end of the world as a mitigation strategy.