The attack surface is only increased for those individuals who reuse passwords. Risk is actually reduced for those who use unique usernames and passwords. GP said nothing about requiring email addresses and provided several other alternatives that require nothing of the user at all.<p>Additionally, the reason you gave as to why the site might require it provides no real value to the user. There is no incentive to link yet-another-website to an authentication provider, except to access the site; which seems completely unnecessary.<p>Finally, I object to categorizing Google, Reddit, et al., as &quot;authentication providers.&quot; While that may be a service they perform, they are actually, instead, just tracking you. If you&#x27;ll forgive the clumsy metaphor of a caffeine-deprived mind, it would be a bit like calling police serving a search warrant &quot;furniture reorganizers.&quot;