3 ms·
I think OAuth and single sign on is great but I always thought OAuth had a similar issue to this. You're on a random website, you click to login via e.g. Google
by seanwilson 9y ago
I think OAuth and single sign on is great but I always thought OAuth had a similar issue to this. You're on a random website, you click to login via e.g. Google and then enter your Google password into the login dialog that appears. It's asking wayyy too much from regular users to be able to tell if this is safe or not. I'm really surprised there haven't been more phishing attempts where a fake login is shown which saves your password.
It's an even worse issue in e.g. Android apps that use Google or Facebook for logins as you can't tell what domain is serving the login prompt like you can in a desktop browser.
- scotu 9y agoI'm almost ok in a web browser, at least there is a reasonable way of being 80% sure it's safe, but the webview version is my pet peeve... not even a power user could be able to tell...
- seanwilson 9y ago> I'm almost ok in a web browser, at least there is a reasonable way of being 80% sure it's safe, but the webview version is my pet peeve I use a password manager on desktop so when it fills in the password for me I'm confident I'm safe. Asking regular users to be sure a real browser pop-up is being shown and the expected domain is shown is asking too much though in my opinion.
- soared 9y agoOne of those recent widespread google docs attack used this strategy to get into lots of business g accounts. https://news.ycombinator.com/item?id=14205432 https://news.ycombinator.com/item?id=14205432
- colemickens 9y agoThat's rather specifically not the same attack. One uses the normal OAuth flow and mis-represents a valid application identity in order to get the user to grant permissions normally. The other flow, that the grandparent refers to, redirects users to a phishing domain and steals credentials.