3 ms·

I got that answer wrong too. But I guess they were asking specifically about phishing. I think the rationale is that the page has to be a real permissions page

I got that answer wrong too. But I guess they were asking specifically about phishing. I think the rationale is that the page has to be a real permissions page to give the attacker access to your data. A fake page won't have any power in that regard. And on a real permissions page, an attacker won't be able to fake the requesting app's link. So: legit page + legit link = no phishing ... even though it is by no means a safe situation.

pvorb 8y ago
The barrier to setting up a "legit" request for permissions for my phishy app is not that high. Yes, you can't phish for Google passwords that way, but you can get access to all other accounts of a person that are not protected by 2FA and can reset passwords via email.