You click "Sign in with Google" on some app you've never used before. A popup flashes, you pick your account, and three seconds later the app knows your name and email. You never typed a password into that app. It never saw your Google credentials. So how does it know who you are? That's OAuth 2.0 and OpenID Connect doing their thing. Almost every app you use either consumes or implements this flow, and the confusion between OAuth and OIDC causes real security bugs in production. Worth unders...