New ask Hacker News story: Ask HN: Developer abused “sign in with GitHub” and users are being punished

Ask HN: Developer abused “sign in with GitHub” and users are being punished
37 by 2Gkashmiri | 12 comments on Hacker News.
The offending website "nopecha.com", which unfortunately i found about a week ago on HN itself appeared to be another captcha service but one that was offering "1 Sec" solve speed for text captchas. i was interested and by the looks of it, a lot of people. their webisite only had "sign in with google" so i didnt bother. The day before i check the website out of boredom and saw "sign in with github". i logged in, clicked through a bunch of pages because its the same drill everytime. i found out that i had "automatically starred their repos". by the looks of it, around 500 "stars", the last i saw. suddenly i am unable to log in to my github and the page just says "account suspended." contacted their support and the last response i got from them was "your ban should stay as you engaged in improper behavior of stars farming" or some other BS. Here is my problem. I am not a part of nopecha. I just used their website once using "sign in with github" button. That is the extent of my involvement. How can github allow the developer to use "sign in with" button to create a situation that they could LATER consider abusive but then go ahead and ban all the victims also? i did not voluntarily want to join their abusive practice, i just wanted a log into the website. (There was no explicit mention of the stars farming practice on the website) Why is github allowing the developer to abuse their Oath in the first place? If this is going to be a norm going forward, i do not see any hope of "sign in with" buttons for any service because then you could be banned from one service and suddenly everything connected to your account is also banned. I honestly expect the "sign in with x" button to provide a frictionless access to a website, thats it. how could the developer abuse that process and the website, instead of acting on the developer alone, are causing trouble to unsuspecting victims?