The button looks harmless because we see it everywhere.

Continue with Google. Continue with Apple. Sign in with Microsoft. One click and you are inside the app without inventing another password you will forget by Friday.

I use these buttons too. They are often the sensible choice. But I think people have become so comfortable with them that they stop noticing the second half of the screen – the part that says what the app wants permission to do.

That is the interesting part.

Convenience is doing a lot of work here

Single sign-on solves a real problem. People create weak passwords, reuse them, lose them and reset them. Letting a trusted identity provider handle authentication can reduce that mess.

It also makes trying a new service ridiculously easy. You click once, approve the account, and the product is ready before you have decided whether you even like it.

This is where the psychology gets clever. Signing in feels like a login decision. Sometimes it is also a data-access decision.

A calendar app may ask to see your calendars. A meeting assistant may want access to email, contacts or files. A social tool may request permission to post or manage something on your behalf. Those requests are not automatically suspicious. They may be necessary for the feature.

But they deserve a different level of attention than a basic login.

Read the boring permission screen

Most of us treat permission dialogs like cookie banners. We look for the button that makes them disappear.

That habit is risky because OAuth – the common framework behind many of these connections – is designed around delegated access. You are telling one service that another service may do specific things with your account.

The word specific matters.

If a tool needs to read your calendar to suggest meeting times, fine. If it wants to edit every event, manage contacts and access your drive as well, I want to know why.

Sometimes permissions are broad because the platform itself offers clumsy categories. Sometimes the developer asked for more than necessary because it was easier. Sometimes the product genuinely needs them.

You do not have to become an identity engineer. Just pause long enough to notice the difference between “see your basic profile” and “read, create, edit and delete your files.”

That is not paperwork. That is capability.

The app can be fine and still become a problem later

Here is the uncomfortable bit: permission is not frozen in time.

You may connect a useful tool today. Six months later you stop using it. The connection remains. A year after that, the company changes ownership, its security weakens, or the account is compromised.

The old permission is still sitting there like a key you forgot you handed out.

This is common because connected apps are invisible after setup. You do not see them on your desk. They do not send a monthly reminder saying, “Hello, we can still read your calendar.”

Every few months, it is worth reviewing the third-party apps connected to your main Google, Apple, Microsoft, GitHub or other important accounts. Remove things you no longer use. If an app needs access again, you can reconnect it.

The tiny inconvenience is worth it.

Work accounts deserve more suspicion

Personal accounts are one thing. Work accounts are another.

A harmless-looking productivity tool may gain access to client files, internal meeting titles, source code or employee information. That changes the stakes.

This is why many companies restrict which third-party apps employees can connect. Users sometimes find that annoying. I understand the frustration – especially when the blocked tool would genuinely save time.

Still, the security team is not always being dramatic.

One employee connecting one app can create a path into information that belongs to hundreds of people. SaaS tools have made this easy enough that employees can build an unofficial software stack without ever speaking to IT.

That is convenient right up until nobody knows which systems can see what.

“Sign in with” can actually be safer than making another password

I do not want this to sound like a warning against social login. In many cases, using a major identity provider is safer than creating another password on a small website.

The identity provider can offer strong multi-factor authentication, suspicious-login detection and better account recovery. The smaller app never needs to store your password.

That is good architecture.

The mistake is thinking that all “Continue with…” buttons are the same kind of decision. Basic authentication and broad account access can sit behind very similar screens.

So I separate the questions.

Do I trust this provider to sign me in? And what exactly am I allowing this app to reach?

Two questions. Ten seconds.

Revoking access is underrated

People often treat account connections as permanent because disconnecting sounds risky.

It usually is not. Revoking access simply means the third-party app can no longer use the permission you gave it. Your main account remains. The app may stop working until you reconnect.

That is useful when you are cleaning up old services or when something feels off.

If an app you barely remember has access to email, cloud storage or code repositories, I would remove it first and investigate later. There is no prize for preserving integrations you do not use.

The same goes after trying a service for a week. If you decide not to keep it, remove the connection while you still remember making it.

The login button is not the boring part anymore

For years, account security advice focused on passwords. Strong passwords. Unique passwords. Password managers.

All still useful.

But modern accounts are increasingly connected through tokens, delegated permissions and app integrations. The password can be excellent while a forgotten third-party connection quietly holds meaningful access.

That does not mean the system is broken. Delegated access is one of the reasons modern apps work together so well.

It simply means the security decision moved.

The next time a new app offers that familiar “Continue with Google” button, use it if it makes sense.

Just read the next screen too.