I did a little poking around in my own acct. and experimented on try. Discourse asks for three different packages from google.
- Google Sign-in code. A really long random code unique to my google account. No identifying information. This is the bare minimum for using google as an authentication provider. This isn’t listed when google asks if I’m sure I want a site to access my acct, but it is seen when I look in my own security settings in my acct.
- Access to see email address. Presumably, used to pre-fill the contact info field.
- Public profile. This comprises all of the data that @drbrake noticed, and it does appear to be one chunk. As has been already discussed, the only part of this that discourse seems to use is the name, again to pre-fill the long name, and this only when creating a new acct. (I choose not to keep that information here on meta, instead using a shorter form. Discourse never complains.)
So the question is, is the convenience of auto-filling forms worth the freak-out factor? The only current options that users have is to accept the whole package, or to reject everything. There seems to be no “I’ll fill in my own profile, thank-you.” option.
For comparison, SE sites only ask for the sign-in code, and email.
SourceForge, back when they did openId, only used the sign-in code.
Somewhat related: https://meta.discourse.org/t/when-creating-account-with-auth-by-google-cannot-change-linked-email/11634