5 ms·

As many others have pointed out, OAuth is extremely susceptible to phishing or snooping of passwords on platforms where the OAuth flow is done in an embedded we

As many others have pointed out, OAuth is extremely susceptible to phishing or snooping of passwords on platforms where the OAuth flow is done in an embedded web view, which can be considered "untrusted", vs. your browser which could be considered "trusted" because you know the URL bar is accurate, and there's no mechanism for 3rd parties to scrape passwords (well, except for user scripts / extensions) OAuth does also remove the burden of securely storing passwords, but so does xAuth.

boucher 16y ago
Of course, OAuth is also vulnerable to phishing in a "trusted" browser, when you're talking about average users who don't really understand how it works. One interesting way to provide "trust" would be to have a system wide "OAuth" view (or, "secure browser," or whatever you want to call it). It would have to contain some piece of user information, like say your user account name and photo, that the app itself is never granted access to. That way, if you're actually paying attention you can verify that the system displayed this view.
- ableal 16y ago
  It would have to contain some piece of user information, like say your user account name and photo, that the app itself is never granted access to. A security seal, defined by the user (one time operation). Yahoo used to have this, and so does my bank in the login page. May be some text, a doodle or picture. Curiously, Wikipedia only seems to know about physical seals. Searching for "security seal login" yields some info.
  - tlrobinson 16y ago
    RSA's implementation (used by BofA, among others) is called SiteKey: http://en.wikipedia.org/wiki/SiteKey http://en.wikipedia.org/wiki/SiteKey These never seemed very secure to me for the reason mentioned in that article: The obvious flaw in the design is that a phishing site can get the correct SiteKey info from the genuine site, then serve it to the user, "proving" its legitimacy[1]. SiteKey is thus susceptible to a man-in-the-middle attack. But at least it requires the attacker to connect to the website, which gives them opportunity to block hosts that are known or suspected to be phishing users.
    - boucher 16y ago
      And of course that vulnerability would not exist here, in that the information would not web accessible, but rather only accessible to the local operating system.

boucher 16y ago

Of course, OAuth is also vulnerable to phishing in a "trusted" browser, when you're talking about average users who don't really understand how it works. One interesting way to provide "trust" would be to have a system wide "OAuth" view (or, "secure browser," or whatever you want to call it). It would have to contain some piece of user information, like say your user account name and photo, that the app itself is never granted access to. That way, if you're actually paying attention you can verify that the system displayed this view.

ableal 16y ago
It would have to contain some piece of user information, like say your user account name and photo, that the app itself is never granted access to. A security seal, defined by the user (one time operation). Yahoo used to have this, and so does my bank in the login page. May be some text, a doodle or picture. Curiously, Wikipedia only seems to know about physical seals. Searching for "security seal login" yields some info.
- tlrobinson 16y ago
  RSA's implementation (used by BofA, among others) is called SiteKey: http://en.wikipedia.org/wiki/SiteKey http://en.wikipedia.org/wiki/SiteKey These never seemed very secure to me for the reason mentioned in that article: The obvious flaw in the design is that a phishing site can get the correct SiteKey info from the genuine site, then serve it to the user, "proving" its legitimacy[1]. SiteKey is thus susceptible to a man-in-the-middle attack. But at least it requires the attacker to connect to the website, which gives them opportunity to block hosts that are known or suspected to be phishing users.
  - boucher 16y ago
    And of course that vulnerability would not exist here, in that the information would not web accessible, but rather only accessible to the local operating system.