[EGreg]

So since you have one identifier, companies can track you across all domains.

They can find out if you are a user of sex.com or dangerouspoliticalopinions.com

They can do this by trying to register an account with your email address, and being told it was already registered.

Here is a tool that allows anyone to do it:

https://www.quora.com/Is-there-a-way-to-know-which-all-sites...

https://brandyourself.com/blog/privacy/find-all-accounts-lin...

[mirimir]

Yes, exactly. Attempts to register with an email that's already used will fail, and so adversaries check whatever sites interest them.

However, I believe that would fail for those using Google or Facebook authentication. But I can't test that, given that I don't have an account with either.

[kortilla]

Everyone? Unless the sites publish a list of logins for everyone to read the only one with that knowledge would be the identity provider.

[EGreg]

Not at all. See above.