I would agree that this is a major flaw, if the "scope" were unrestricted. But most of these systems support a capability-style model where you can say: "I giv

I would agree that this is a major flaw, if the "scope" were unrestricted. But most of these systems support a capability-style model where you can say: "I give you permission to let me log in as myself, for this particular web site. But you have no other authority to do anything else as me." For example, "email" scope: https://developers.google.com/+/api/oauth#email https://developers.google.com/+/api/oauth#email, or the Permissions in Facebook login: https://developers.facebook.com/docs/facebook-login/permissions/v2.2 https://developers.facebook.com/docs/facebook-login/permissi... Another reason why I don't feel happy about forcing people to make passwords for random web sites: most people are really bad at understanding risky computer behavior. Do you have a parent or relative who uses the same password for everything? I do. Despite my best efforts to warn them, they are not convinced that this is a dangerous thing to do. I don't think they're alone in this. Education is not enough.