Offloading this is a huge privacy fail. It probably is a security win, but it's a huge privacy fail. Here Google/FB/etc, get MORE information for your giant catch-all, know-all database, thanks!
Unfortunately better alternatives that are not a security win don't really exist yet.
Asked another way -- if I sign into a website using FB auth, am I also signing into FB itself at that time? And so can be tracked around the web as if I had logged into FB directly?
But just the fact that an app uses Google authentication doesn't give Google any kind of privileged access to that app's data (beyond purely the data that they're logging in on this browser at this point in time) unless the app is pushing data actively back to Google (which they could do anyway for a gmail-managed email address, I guess) or you believe that Google will then subsequently forge authentication requests to that app and pull data out itself. Both of these things are hypothetical violations of your privacy enabled by using auth-with-Google, but for most use cases are rather unlikely, I would guess.
For that they handle the complete user registration, recovery & auth process for you, with all the work and pain attached to it.
Granted if your OAuth provider were really evil, they could log into the users App X account and access whatever data he has inside the app, so you have decide if that a concern or not.
For a hello world app, no big. For a game app, what happens when your employer buys the data, and notices you are playing games on "company" time... Of course lots more privacy failures can be easily imagined here. I picked low privacy failures, but larger failures are very easy to imagine.. Especially when we know that most large governments also have this data, directly siphoned from Google/FB/etc.
For some applications, that privacy loss may not be a big deal. Except if you combine this information with the other 500 web apps the user also uses through 'Sign in with...' links, plus all the other information they gather, they suddenly get to know you really, really well.
That in itself could be giving away a lot of personal information. Merely knowing that someone visits a particular web site regularly could disclose their sexual orientation, health/mental issues, financial status, religious or political affiliation, etc.
If FB or Google then starts serving you ads that reflect these associations, it could publicly leak information about you that you don't want leaked. In some countries, having the "wrong" sexual orientation or political association could be deadly.
I wouldn't sign up to my own side project if I had to use either in that case.
It's one less password to manage...
* I have a password manager because I have to manage 100s of passwords already and most aren't moving to Google anytime soon. * There are a few occasions where I've had to share my credentials with friends or family. It's nice to change the password temporarily and not give them access to my whole Google account. * I don't want to sign into Google on every devices/computer. Similar to the passwordless recommendation: I don't want to sign into email on every device I use the account on. * I don't want Google to know anything about me it doesn't have to. I have a Facebook account and Google account, but I rarely log in. I switched my email away from Google years ago for this reason. * What if I want to create a test account or second account to play around?
I like the idea of single signon, but I don't trust the Big Boys with my data. Exclusively having "sign up with" buttons usually makes me leave the site.
I wish we had better federated sign-in solutions, but open-id probably won't be it... and U2F while cool won't solve the account recoverability problem.