With federated login you only have one provider that ever stores your password. There are fewer password hashes (or plain text) floating around in random datab

With federated login you only have one provider that ever stores your password. There are fewer password hashes (or plain text) floating around in random databases. You can change your password once, and change it for numerous passwords. It is just easier to maintain good security with one login instead of many. It may not be more secure than a perfectly set-up browser and server; but surely it is in typical circumstances. In the case of key fob style three factor authentication a shared secret usually needs to exist. If the password hash, and the shared secret are stored on the same database; a hacker could get access by only needing to compromise that one server. By offloading the three-factor to a third party you are reducing that risk. Even with SMS style authentication a temporary shared secret exists (the contents of the text message). Of course if you are using federated login, it does present a single point of failure. You could argue that a private key is cryptographically better than a shared secret. But if the client machine is compromised the additional security is useless; and just gives you a false sense of security.