Suppose the following scenario:
- A cloud service reports a breach in which user account information (usernames and password data, e.g. password hashes) was accessed.
- The attacker has sufficient resources to recover passwords from the hashes (worst-case assumption, not necessarily realistic)—or the service used a sufficiently weak hash algorithm (or even stored passwords in plain text).
- Alice has an account on that service. However, she logs in with her Google account.
If the designers of the authentication protocol used did their homework, I assume the compromised service would not hold any data that would enable an attacker to access Alice’s account, and Alice would not need to take any actions in response.
Is my assumption correct, or have I overlooked something?
