We’ve all seen that one button. The simple, and straightforward one that’s on most login and sign up pages on almost every login page today.
“Continue with Google”
It just works. It’s fast, and it’s convenient.
But am I the only one who wonders “what happens if Google randomly disappears?”
Yeah, I understand that there are layers of safeguards behind the scenes that prevent that whole scenario from happening. But definitely, I couldn’t just let this thought slide.
In essence, this article is basically about understanding how SSO (Single Sign-On) works. You know it as the “Continue with Google” button; engineers call it SSO.
We’re going to look at everything from the moment you click that button to the terrifying realization that you don’t own your identity.
The chances of Google actually disappearing are quite low.
That’s a black swan event; an unpredictable event, quite extremely rare too… with severe consequences. Think of events like the 9/11 attacks or the 2008 financial crisis.
Those consequences in the possibility that Google disappears are exactly what we’d be looking at in this article.
We have traded sovereignty for convenience, creating the biggest “Single Point of Failure” in internet history.
How does “Continue with Google” actually work
Whenever I’m asked this question, I like to compare the login system with the “ticket at a club” scenario.
Let’s assume you want to sign into your Spotify account.
Instead of you having to type in your email address, and then enter your password, you click the “Continue with Google” button.
We can say Spotify is the “Club”, and Google can be synonymous to the “Club Bouncer”.
On clicking that button, you are basically asking Google to give you a “wristband”.
See, Spotify doesn’t actually want to know who you are. They don’t want to see your ID, and they definitely don’t want to be responsible for holding “your wallet” (your password).
They just want to know if you’re cool to enter. {Funny how this isn’t just Spotify, but a lot of other tech companies.}
So, the handshake, behind the scene, looks like this:
You tell Spotify, “Let me in.”
Spotify says, “Go ask the Bouncer (Google).”
You go to Google, show your ID (log in), and prove you’re you.
Google hands you a stamped wristband (technically called an Access Token).
You walk back to Spotify, show the wristband, and they wave you through.
It’s seamless. It’s brilliant. It’s OAuth 2.0 and OpenID Connect in action.
But this is the part that everyone seems to miss: Spotify never actually met you. They only met the wristband. And that wristband has an expiration date. Every hour or so, Spotify has to run back to the Bouncer and ask, “Hey, is this guy still cool?”
Now, the engineers reading this will say, “Actually, Spotify doesn’t check with Google for every single click; they verify the cryptographic signature locally.” {more technical words like that 😂}
And they’re right. For a short time, you are free.
But that wristband (the Access Token) has a short lifespan (usually about an hour). When it expires, Spotify has to quietly go back to the Bouncer and ask for a new one using a Refresh Token.
This is the choke point.
Now, in our scenario where our Bouncer, Google suddenly disappears, or just decides they no longer like your face, and bans your account… The answer to Spotify’s question about you “still being cool” is a big, hard “NO!”
The refresh request fails, and the bouncer refuses to renew your pass.
And just like that, the club, Spotify (or any app, but you get my point 🥲) kicks you out… not fully knowing what you did, but just because the bouncer, Google, said they no longer like you.
The idea is quite crazy if you think about it, but it’s just the truth {but again, wow 😂}
The problem now is… As Google kicks you out, you don’t have a backup ID. You don’t have a password, and effectively, you become a stranger to your own library.
This isn’t just a Spotify problem.
This logic applies to every corner of your digital life. Your Zoom meetings, your Notion workspaces, your Figma designs… thousands of services we rely on every day are built on this exact handshake.
We like to think of the internet as a vast, open sea of independent islands. But the reality is much more claustrophobic. For most of us, the web has become a series of locked rooms, and we’ve let Google hold the only master key.
The point is clear: You don’t actually have a relationship with these apps. You have a relationship with the Bouncer, and the apps are just following his lead.
So Why do we take this “risk”?
Out of 8 billion people on Earth, I’m definitely not the only one staring at that button with a bit of side-eye.
I remember a weekly stand-up at a startup I was working with.
The lead developer and the designer were debating the onboarding flow: “Should we even build a custom login form, or just have the ‘Continue with Google’ button?”
If it were up to me, I’d choose the Google button every time.
Why? Because it’s functional. It’s frictionless. And frankly, the alternative has historically been terrible.
If we didn’t have Google SSO, the average user would likely use the password Password123! for their bank, their email, and their Spotify. The moment one obscure site got hacked, their entire life would be wide open.
In that sense, Google is a Great Defender. They employ the best security engineers on earth. They stop phishing attacks and handle 2FA with a level of sophistication a small startup could never dream of. By centralizing identity, we actually made ourselves safer from hackers.
It feels like we’ve won. We outsourced our biggest headache to the experts. But ah yes, there’s a catch. In solving our Security problem, we inadvertently created a Sovereignty problem.
We made the walls of the fortress much higher, but we gave the only key to the landlord. We traded the risk of being robbed for the risk of being evicted.
The Problem with Centralized Systems
This isn’t just about losing access to a playlist. For the modern economy, this is an existential threat.
Consider a YouTuber or a freelance developer. Their Google Account isn’t just an email; it is their:
-
Archive (Google Photos/Drive)
-
Rolodex (Contacts)
-
Bank (AdSense/Google Pay)
-
Passport (SSO for generic sites)
If an automated bot flags a file in their Google Drive as “suspicious”, even falsely, the entire account can be suspended.
In the physical world, if a bank freezes your account, they don’t also come to your house, lock your front door, and confiscate your passport.
But in the digital world, that is exactly what a Google ban does. It is a civil death.
Given that you understand the scenarios here… Now we talk about the structural philosophy we’ve all blindly accepted: Centralization.
The internet was originally designed to be decentralized. Think of it as a messy web where every node was equal. But over the last decade, we’ve slowly reorganized it into a “Hub and Spoke” model.
Here’s a quick visualisation between the two model types mentioned.
An Image of how the Internet was initially designed to be; Decentralized
An Image of the Hub and Spoke Model; Centralization.
As you think about it, it makes sense on paper. Google has thousands of security engineers; a small startup has maybe two or three. Trusting Google would be the safer option right?
Until the bus crashes.
In systems engineering, we call this a Single Point of Failure (SPOF). By routing the identity of the entire internet through three or four main providers (Google, Apple, Meta), we have created a “Bus Factor” of 1.
Writer’s Note: For non-technical readers, in tech terms, a ‘Bus Factor’ is how many people need to get hit by a bus before your project dies. For the internet, that number is currently terrifyingly close to one.
We saw a glimpse of this in December 2020. A boring internal storage tool at Google ran out of quota. For 47 minutes, the Bouncer went on a coffee break. The result? It wasn’t just that people couldn’t check Gmail.
-
Students couldn’t log into Zoom for finals.
-
Designers were locked out of Figma.
-
People with Nest thermostats literally couldn’t change the temperature in their own homes.
In a blink, entire workflows and daily routines were frozen… all because one system hiccuped.
We have built a digital world where we are tenants, not owners. We are building our houses on rented land, and the landlord holds the only set of keys.
If you think this is paranoia, just look at the last 18 months. We’ve had clearer warnings than ever that “Too Big to Fail” is a myth.
Remember the day the airports stopped? A single bad software update from a security vendor (CrowdStrike) took down 8.5 million Windows devices worldwide (July 2024).
The Reality Check: It wasn’t a hacker. It was a typo in a code update.
The Connection: While this wasn’t strictly an SSO failure, it proved the “Single Point of Failure” theory. Hospitals, banks, and airlines were paralyzed because they all relied on one vendor. If that vendor makes a mistake, the world stops.
Less than two weeks later, Microsoft Azure faced a massive outage caused by a DDoS attack that their own defense systems mishandled.
The Impact: It lasted nearly 8 hours.
The Connection: Companies that built their entire login infrastructure on Microsoft’s cloud were left in the dark. You couldn’t just “switch providers” because your identity data was locked inside the burning building.
In more recent news, we ended 2025 with a series of wobbles from Cloudflare and AWS. These were shorter, but scarier.
The Impact: Random “500 Errors” across the web.
The Connection: These showed us that even if Google is fine, the pipes connecting you to Google are fragile. If the road to the “Bouncer” is broken, you still can’t get into the club.
These events weren’t anomalies; they were stress tests. And the system failed.
Is There Actually a Better Way?
So, we have a broken system. The obvious question is: “How do we fix it without making life harder?”
For a long time, the answer was “you can’t.” You either trusted the Bouncer, or you stayed home.
But recently, a new architectural concept has moved from theoretical whitepapers to actual code. It’s a solution that sounds radical only because we’ve become so used to digital servitude.
The concept is Self-Sovereign Identity (SSI).
What if your login didn’t belong to a corporation, but to you?
I know, I know. Usually, when people start talking about “decentralization” or “Web3,” your brain jumps to expensive JPEGs, crypto scams, or finance bros. But if you strip away the hype and the noise, the core engineering philosophy is the only logical answer to the “Single Point of Failure” problem. It stops being a buzzword and starts being a lifeboat.
It proposes a shift from a Federated Model to a Sovereign Model.
In the Google model: Google owns the keys. You ask permission to use them.
In the Sovereign model: You own the keys (stored in a decentralized wallet or vault). You grant the app permission to see who you are.
Think of it like the difference between a hotel and a house.
In a hotel, the front desk can deactivate your key card at any moment. In a house, you own the deed and the deadbolt. Even if the construction company goes out of business, your key still turns the lock.
The Reality Check
Now, I’m not saying you should delete your Google account and move your life to a blockchain wallet today {well, that would be dumb 😂}
I’m a realist.
The user experience of the “Sovereign Web” is still clunky. It’s intimidating. In the Google world, if you’re forgetful, you click “Forgot Password.”
In the Self-Sovereign world, if you lose your private key, you lose your digital identity… FOREVER.
And in cryptography, “forever” actually means forever.
But it’s the truth. We’ve heard tales about people who have lost access to their crypto tokens, just cause they lost 12 words {And yes, I’m underplaying the value of those 12 words}
There is no customer support to call when you are the one in charge. That is a different kind of fear, and it’s exactly why mass adoption hasn’t happened yet.
Sometimes, I wonder: “Do I really want to manage 12 words for every single app I use?” Probably not.
But despite the clunkiness, the architecture laid out here is the correct answer to the centralization problem. We are currently in the “dial-up” phase of identity… it’s slow and noisy, but it’s the only way out of the trap.
Conclusion: The Middle Ground
So, where does that leave us?
We aren’t going to stop using Google SSO tomorrow. It’s too fast, too convenient, and frankly, too embedded in our lives.
But we need to stop being blind to the trade-off we are making. We can’t keep building our entire digital lives on rented land and acting surprised when the landlord changes the rules.
Convenience is a hell of a drug, but it shouldn’t be a suicide pact. We need to start treating our digital identity like our physical one: something we actually hold, rather than something we borrow.
So, here’s a survival guide for us all, the “prudent tenant”
-
Audit Your “Must-Haves”: Go to your most critical apps: your bank, your primary work tools, your password manager. Check if you can add a direct email/password login alongside your Google button. Most apps allow this; we just never bother to do it.
-
The Data Lifeboat: Regularly use tools like Google Takeout to export your data. If you are evicted from the “Google house,” you want to at least make sure you’ve packed your bags. I discovered it while researching this piece. It generates a full export of your account data in portable formats.
Google Takeout | https://takeout.google.com/
-
Diversify Your Identity: Don’t put all your eggs in one basket. Use “Sign in with Apple” for some things, or a dedicated email for others. It’s a bit more work, but it raises your “Bus Factor.”
Don’t forget. Bus Factor is the number of people that need to get hit before your project dies 🥲 -
Keep an Eye on the Exit: The “Sovereign Web” is coming. It’s clunky today, but so was the internet in 1995. Keep an eye on decentralized identity tools as they mature.
In all, if the Black Swan ever does arrive… whether it’s a policy ban, a cable cut, or a corporate collapse, you don’t want to be the one standing outside the club, arguing about a wristband that no longer exists.
It’s time to stop just clicking buttons and start holding your own keys.
If this resonated, share it with someone who clicks “Continue with Google” every day.