4 ms·

any phishing email could just directly link to a fake Google login form. Oauth just adds extra steps for the attacker.