For your and everyone else's information, in case you or they don't know, that's not how it works.
Single sign on goes:
- you ask [website] to login, the [website] sends you to google.
- You log into google and give access.
- google sends you back to [website], with the authentication that you're [specific google user]. And now you're logged in.
The whole thing requires extremely regular and normal https requests. There is no need for any proprietary blob. The thing that shows up on the website is often a picture that acts as a link. Companies offering single sign on usually ask websites who want to use it, to use specifically prepared images for branding and for users to recognize and go "I have used [company] single sign on before, I can use this safely!"
The only downside to single sign on is that [google] knows that you, [google user] are using [website].
Yes, but the reason people still use SSO is that security is hard. If a website uses SSO, they don't need to store any password information. Reuse of tech and keeping the number of sources that have sensitive data small, are good.
Priorities and orders of magnitude. If we can get people to quit instagram and to join pixelfed, I think that's a relative improvement, even if the google SSO is still not ideal. You are right, SSO with google is not ideal.