  Single sign-on authentication systems such as OAuth 2.0 are widely used in
web services. They allow users to use accounts registered with major identity
providers such as Google and Facebook to login on multiple services (relying
parties). These services can both identify users and access a subset of the
user's data stored with the provider. We empirically investigate the end-user
privacy implications of OAuth 2.0 implementations in relying parties most
visited around the world. We collect data on the use of OAuth-based logins in
the Alexa Top 500 sites per country for five countries. We categorize user data
made available by four identity providers (Google, Facebook, Apple and
LinkedIn) and evaluate popular services accessing user data from the SSO
platforms of these providers. Many services allow users to choose from multiple
login options (with different identity providers). Our results reveal that
services request different categories and amounts of personal data from
different providers, with at least one choice undeniably more
privacy-intrusive. These privacy choices (and their privacy implications) are
highly invisible to users. Based on our analysis, we also identify areas which
could improve user privacy and help users make informed decisions.
