14 ms·
Hackers use OAuth, fake Google apps to phish users
- chatmasta 9y agoRelatedly, be very careful which apps with "native browsers" you enter 3rd party credentials into. For example if you install an app and it opens a WebView with the google login screen, the app can read and write any arbitrary content to and from the DOM in the WebView. Not sure about android but this is definitely possible on iOS.
- willow9886 9y agoGood point. Web views are no good. Google has introduced the new app auth libraries (for iOS and android) which are more secure. My business partner wrote a blog about this topic: https://www.linkedin.com/pulse/webviews-bad-use-appauth-mike-schwartz https://www.linkedin.com/pulse/webviews-bad-use-appauth-mike...
- hdhzy 9y agoNote that web view oauth logins to Google are disabled since 20th of April: > On April 20, 2017, we will start blocking OAuth requests using web-views for all OAuth clients on platforms where viable alternatives exist. Source: https://developers.googleblog.com/2016/08/modernizing-oauth-interactions-in-native-apps.html https://developers.googleblog.com/2016/08/modernizing-oauth-...
- m-p-3 9y agoI'm honestly surprised it took them that long to abuse OAuth.