I mean, I see this as a culmination of the response to the OAuth phishing attack that happened a few months ago [0]. Red flags should go up if you were accessin

I mean, I see this as a culmination of the response to the OAuth phishing attack that happened a few months ago [0]. Red flags should go up if you were accessing a site yesterday via OAuth, and all of a sudden today on the same site you get an angry full-page alert that "so-and-so wants your credentials, but they haven't been verified yet". I also noticed the presence of the domain name on the OAuth page, which certainly helps but is probably not widely noticed in practice. It's certainly worth acknowledging that even if users aren't truly blocked, they may be turned away from legitimate apps that just haven't gone through the review process yet -- too many extra clicks, concerns about the legitimacy of the app, whatever. I wonder how this in particular differs from the vetting process for any mobile app store (Apple's App Store in particular comes to mind with its reputation as a walled garden [1], but Android does also warn the user when enabling the installation of third-party apps not on the Play Store). [0] http://www.pcworld.com/article/3194816/security/google-docs-phishing-attack-underscores-oauth-security-risks.html http://www.pcworld.com/article/3194816/security/google-docs-... [1] https://en.wikipedia.org/wiki/IOS_app_approvals https://en.wikipedia.org/wiki/IOS_app_approvals Disclaimer: while I work at Google, I have nothing to do with OAuth or any other user-facing interface.