For some reason this only just now occurred to me: What’s to stop some web site from carefully crafting an imitation of the Google “you need to sign in again” UI, storing your Google password, and storing from the other side the auth cookie from Google, so that it can then poke around through 100% of your Google content including any other site you’ve signed into with the same SSO login?
This is such a fundamental flaw in the whole concept that it’s obviously occurred to people and they’ve had time to come up with something to prevent it, but I can’t see how you could prevent it. Have I missed something? You might have a non-Google URL in the address bar during the faked sign-in, or you could use varying degrees of deception to attempt to make the address bar look legit, but I’d honestly be surprised if more than 20% of people even check the address bar every time they sign in to SSO. I don’t.
So what’s to make this not work?
This is why it is a bad idea that the Google (and other major) SSO use a bazillion domains and redirect you around so much. You can’t really rely on the user knowing the URL of the sign-in system that way.