Using the same password everywhere means a hacker only has to break the weakest of any service you use to get at all your accounts. Using oauth or any single-si

Using the same password everywhere means a hacker only has to break the weakest of any service you use to get at all your accounts. Using oauth or any single-sign-on system allows you to put all your eggs in one (potentially) more trusted basket. Your scenario certainly is a legitimate concern, but it depends on how the other services implement account linking. If you create a non-oauth account and then sign in with Facebook, some services will allow you to link the accounts based on your email address matching, others won't. Of course in the case of Google, if someone hacked your account, they would probably also have access to your Gmail and could reset passwords from any other service. So the risk isn't significantly different. As a general rule, I only use oauth SSO on sites that I trust less or care about less than my oath provider.