An in-app browser isn't the only way to provide OAuth, on most platforms you can invoke a URL and the browser application will open on the phone. For example,

An in-app browser isn't the only way to provide OAuth, on most platforms you can invoke a URL and the browser application will open on the phone. For example, on iPhone you can invoke an HTTP(s) URL, your app will exit, mobile safari opens, and you can then login and know that what you are typing is as secure as the OS/app sandboxing is....take a look at how the Facebook iPhone SDK flow works, its actually quite nice and very easy for users. In reality, if you want to know that you aren't giving your username/password to a malicious third party, as an end user, you have to deal with a little inconvenience...being redirected in your browser to an SSL page that you trust, for example.