Telling Google where you are.

In addition to the downsides mentioned here about privacy regarding Google, there is a major upside to using this service: it offloads all of the authentication logic to google, so in theory it reduces your risk surface area, or it may be more accurate to say it concentrates your risk to your Google account.

You'd like to hope most websites use using common security best practices and keep on top of things but the amount of websites I had accounts on (on websites I had long forgotten) which have been pwned over the years tells me otherwise. Using google auth sets your account security to be exactly as secure as your Google account.

In addition to allowing Google to manage the authentication process, signing in with Google allows Google to track your visits. In some cases they get additional data about content you view.

In many cases the mere presence of that button allows Google to track that your device visited the Udemy sign in/sign up page, even if you don’t click it. Google uses this to create and update a profile of you they sell for advertising and other purposes, and exposes you to more risk if your Google account is breached. With a password manager I find using SSO to be about the same level of effort as using my manager’s autofill functionality

One thing not mentioned is that if you ever want to "de-Google", you will have to go to all websites and services where you logged in using your Google account, and (try and) change the authentication method. Avoid it if possible.

Udemy with email: Udemy gets your email, and will probably require a verification process to verify that you own it:

Udemy with Google Sign in: You click through in your browser, to authorize Udemy to obtain some details (usually just email + basic profile details), Udmey gets a "token" (effectively a random string) which they can send to google to retrieve these other details, and verify you still have an account and you (or google) haven't revoked access, which they can use now and in the future. They don't need to verify your email as they have a token that is "proof" already. To you it's a click through, to everyone else it's a bit more complex. If Udemy has a data leak, if they didn't store your email directly, it's possible that the token could be reset before someone is able to obtain it. But it's unlikely they aren't obtaining the email address as soon as you log in and storing it.

A couple of things come into my mind. Note that this isn't exhaustive.

• Google will obviously know you signed up for that service. Additionally, they will know when you log into your account.
• Google may provide personal information that are listed in the signup screen, such as your name, birthday, etc. You will be notified of what will be provided (highly doubt Google would blantly lie about this part), and it's up to you to decide whether you want to provide them or not. The site itself may ask for more than necessary.

It's a protocol called OAuth that pretty much lets google or whatever "sign in with XYZ" company take over the login process then share a unique identifier+ all information requested by the app on that "allow 3rd party to access the following" page. It's essentially letting Google manage the user/password authentication instead of udemy.

I signed up for a bunch of things with my Facebook account, then I lost my Facebook account. I also lost most of those accounts.

Google is more secure. Through email is more private. Theoretically.

Google claims they don’t monitor the sign in with Google for their data collection. So signing in with Google means you authenticate with Google and then Google tells udemy you are who you are. Don’t cite me but I’m pretty sure Google’s authentication security is one of the best compared to almost all sites. And that’s before you sign up for their more advanced account protection. Since this is the privacy sub you should be aware that if Google is lying, then they’ll know every time you sign into Udemy.

A middle ground is that Google knows every time your browser needs an authentication token for Udemy, so worse case they know your an active Udemy user when you get a new token every 30 days.

E-mails is a one and done deal. Google knows you created a Udemy account. Google does not know how active you are as user (again they claim the sign in data is only for security and not used for advertising). Which is probably a moot point, their AI can read the Udemy “wow you beat your record this week” email vs the Udemy “we haven’t seen you in a week” email.

Also wtf, get a proton mail account (yes I’m a shill for them).

If you get your YT account banned, and that happens all the time becasue the bots are going nuts, you will lose gmail as well.

I am not sure what Udemy is or how it works, but on most websites that have a "sign in with Google" link, it means that you don't actually have a separate password for that website, instead you authenticate yourself by having a cookie for your Google account set in your browser.