Also. HOW do you know it’s a real Google sign-in instead of a fake password stealing form?

We’ve trained generations of users to accept it’s alright to give their Google/Facebook/Twitter credentials to any random site under the sun.