Interesting write-up on how an ARG messed up using the Google Identity Platform