"Sign in with Google": Why It Bounces You Out and Back

Clicking the "Sign in with Google" button takes you to Google's site for approval, then back to the original site with a one-time authorization code. This passcode allows the original site to access your Google account without knowing your password, creating a secure single-use ticket. The original site is not storing your password and can only use the passcode to access your account under specific conditions and for a limited time.

This system was introduced to replace older methods where passwords were shared with third-party sites, which was risky as passwords were often stored in plain text and could potentially be misused. The new system maintains your password's security while still allowing third-party services to access your account.

The approval step is crucial as it gives you a clear view of what permissions you are granting. However, people often make mistakes when approving these requests, such as not fully reading the consent prompt or not realizing that the third-party app can access various parts of their Google account like email and calendar.

While "Sign in with X" doesn't guarantee the security of the third-party site, it does ensure that your password isn't shared. OAuth is an authorization protocol, not a login protocol, and its latest version includes mandatory Proof Key for Code Exchange (PKCE) for enhanced security.

You can revoke access to third-party apps under 'authorized apps' at any time. So even if a malicious app gets your passcode, it can't be used indefinitely and you have the ability to limit its access.