I just added my google account to gnome-online-account, assuming it'd use OAuth. I should mention I use two factor authentication. I wrote in my google password + my verification key (but chose not ...
As with anything that wants my passwords I want to know about the how safe it is to use the gnome-online-accounts [g-o-a] feature (and how it can be exploited). I'm only interested in the Google part ...