Using the 'Sign In With Google' option is risky and there is currently no workaround

Logging into a website using the "Sign In With Google" option is so convenient that you've probably used it hundreds of times. However, researchers have found that using this feature as an employee of a business can put you at risk of having your privacy violated, and worse, there's no fix yet.

The "Sign In With Google" feature leaves traces of previous users in the domain

A vulnerability has been discovered in Google's OAuth system that affects anyone who worked for a company that allowed its employees to use the now-defunct "Sign In With Google" login, Trufflesecurity reports.

The problem here is that when you are an employee of a company and you use the 'Sign In With Google' feature to log in to an app like Slack with your business account, the app gets two pieces of data: the domain and the email address. If the app gets both of these pieces of data, it will let the user log in.

The 'domain' portion is the business domain name, which tells the app that you're an employee of that particular company. However, if the company goes out of business, a bad actor could purchase and take ownership of the unused domain. If the business doesn't 'clean up' properly before closing, the bad actor could recreate employee email addresses and use them to log into third-party services.

Fortunately, the bad guys couldn't get into the company's old Gmail account and read their emails, but Trufflesecurity found that it could access former employees' accounts on ChatGPT, Slack, Notion, Zoom, HR systems, and more. And while all of these accounts can store sensitive data, HR systems are the most dangerous because they contain information like social security numbers and banking information.

Unfortunately, when this vulnerability was first reported, Google blamed the companies for not properly deleting their data. However, after Trufflesecurity demoed the attack at Shmoocon (which you can see in the video above at the 5:34:00 mark), Google had to reconsider.

In the meantime, if you used 'Sign In With Google' while working for a company that has since gone out of business, your data could be compromised. Keep track of your details and be prepared to fix the problem if you notice a data breach. And even if you never use the handy sign-in feature while working, there are plenty of reasons why you shouldn't use 'Sign In With Google' on any website ever again.

Samuel Daniel

Update 16 January 2025