5 ms·

A less technical vector is that users are continually trained to think it's ok to enter their username and password in any old app that throws up a webview. Phi

A less technical vector is that users are continually trained to think it's ok to enter their username and password in any old app that throws up a webview. Phishing here we come... I spent a while complaining every time I saw one and nearly always got brushed off. Then I realised that even large companies do this. The most recent example was Microsoft doing it in the Windows Gamebar! So I give up. If anyone wants to harvest passwords just release a few apps that claim a legitimate need to login to Google, Facebook, Amazon or anything else you want access to. EDIT - what's the correct thing to do? Launch the user's browser where there is a slightly higher chance that they will be able to spot that things aren't legit. And if they are using a password manager that will refuse to fill in the site and is much more likely to alert them. The two simple rules: 1. Never enter your password in a 3rd party app 2. Always use a password manager are simple to explain to non-technical users and fairly robust.

jt2190 6y ago
> Launch the user's browser where there is a slightly higher chance that they will be able to spot that things aren't legit. Some sites allow and encourage the user to customize their login page. The attacker the must reproduce the unique login page for each user.
- andybak 6y ago
  At that point they have already entered their credentials. Unless I'm misunderstanding you? The webview is equivalent to "show the login page in a sandboxed browser" - there is no memory of any customization.
  - tsimionescu 6y ago
    Usually this happens after you enter your username/email but before the password. It's very common with company logins - you first want to login to Azure, you get redirected to login.microsoft.com, you enter your company email, you get transfered to your company's login.company.com page. The same can be done with a personal login page.
    - andybak 6y ago
      I've personally never seen this with any "in-app" oAuth page. I don't think it changes my fundamental point.
- vladvasiliu 6y ago
  But how much of a hurdle is that? The login page is likely accessible by the attacker, who can then copy it. Sure, it's a bit more work than setting up a random HTML form, but if you're already running a somewhat targeted attack it may be worth it. It's also not clear to me why the apps don't launch the system browser. The IntelliJ IDEs do this. Added bonus is the sign-on is actually... single, since I'm probably already logged in to the service. Even a command-line tool, awscli, is able to figure out how to launch a browser, use whatever session is active, populate the device code on the form, etc. All I have to do is click the button "yup, I actually asked for this happen". And this is running on Linux without a fancy DE or anything. MS Teams however, does it in its own browser, restarts five times, etc. It seems to me that this idea of simplification (the user doesn't even have to switch apps!) has been pushed too far, to the point of actually making things more complicated for the user and in the process decreasing security.
- elliekelly 6y ago
  When I log in to my bank I recognize the little icon I chose but I’m not sure I’d notice its absence. I suspect I wouldn’t.
UncleMeat 6y ago
People say this, but I'm not convinced that the population of people who would be fooled by phishing after being trained by OAuth is meaningfully higher than the population of people who would be fooled by phishing without this training. People are awful at recognizing phishing. Straight up.
- andybak 6y ago
  > the population of people who would be fooled by phishing That population includes me. I'm in danger of being phished by 3rd party apps. > People are awful at recognizing phishing. Straight up. Yes - which is why password managers are a key part of the solution. They match on URLs and require an extra step to bypass.
  - UncleMeat 6y ago
    Password managers can autofill the OAuth page just fine. Wouldn't that mean that there is no problem with OAuth making phishing more dangerous?
    - andybak 6y ago
      Not sure I follow your reasoning here. The reason password managers make websites safer as opposed to apps is that the match the url and fill in the credentials automatically. If you are being phished, the urls won't match and the password manager will usually warn you if you try and force it to fill in the credentials. For a webview inside an app - they don't autofill anything and it's always manual - meaning the user has to be vigilant.
      - UncleMeat 6y ago
        > For a webview inside an app - they don't autofill anything and it's always manual - meaning the user has to be vigilant. But that has nothing to do with OAuth. A malicious app can already phish you by impersonating another app.
kerng 6y ago
Not just old apps, recently I saw Robinhood/BlockFi/othere use Plaid, and Plaid pops up a dialog to enter your bank account credentials! I'm not kidding. Of course there is a note that you dont have to worry and all is fine. Reminded me of Mint which did the same when I looked at it a few years ago. The financial system is so far behind tech wise its crazy, maybe even irresponsible.
- Operyl 6y ago
  At the very least, Plaid's finally getting official oauth2 integrations with a lot of the big banks. It'll be eons before we get such integrations with small banks, though. For example, Plaid now will open the banking app on a mobile device to continue authorization.
donmcronald 6y ago
> enter their username and password in any old app that throws up a webview And 2FA codes. And TOTP codes. From what I’ve seen users have been trained to enter credentials everywhere and constantly.

jt2190 6y ago

> Launch the user's browser where there is a slightly higher chance that they will be able to spot that things aren't legit. Some sites allow and encourage the user to customize their login page. The attacker the must reproduce the unique login page for each user.

andybak 6y ago
At that point they have already entered their credentials. Unless I'm misunderstanding you? The webview is equivalent to "show the login page in a sandboxed browser" - there is no memory of any customization.
- tsimionescu 6y ago
  Usually this happens after you enter your username/email but before the password. It's very common with company logins - you first want to login to Azure, you get redirected to login.microsoft.com, you enter your company email, you get transfered to your company's login.company.com page. The same can be done with a personal login page.
  - andybak 6y ago
    I've personally never seen this with any "in-app" oAuth page. I don't think it changes my fundamental point.
vladvasiliu 6y ago
But how much of a hurdle is that? The login page is likely accessible by the attacker, who can then copy it. Sure, it's a bit more work than setting up a random HTML form, but if you're already running a somewhat targeted attack it may be worth it. It's also not clear to me why the apps don't launch the system browser. The IntelliJ IDEs do this. Added bonus is the sign-on is actually... single, since I'm probably already logged in to the service. Even a command-line tool, awscli, is able to figure out how to launch a browser, use whatever session is active, populate the device code on the form, etc. All I have to do is click the button "yup, I actually asked for this happen". And this is running on Linux without a fancy DE or anything. MS Teams however, does it in its own browser, restarts five times, etc. It seems to me that this idea of simplification (the user doesn't even have to switch apps!) has been pushed too far, to the point of actually making things more complicated for the user and in the process decreasing security.
elliekelly 6y ago
When I log in to my bank I recognize the little icon I chose but I’m not sure I’d notice its absence. I suspect I wouldn’t.

UncleMeat 6y ago

People say this, but I'm not convinced that the population of people who would be fooled by phishing after being trained by OAuth is meaningfully higher than the population of people who would be fooled by phishing without this training. People are awful at recognizing phishing. Straight up.

andybak 6y ago
> the population of people who would be fooled by phishing That population includes me. I'm in danger of being phished by 3rd party apps. > People are awful at recognizing phishing. Straight up. Yes - which is why password managers are a key part of the solution. They match on URLs and require an extra step to bypass.
- UncleMeat 6y ago
  Password managers can autofill the OAuth page just fine. Wouldn't that mean that there is no problem with OAuth making phishing more dangerous?
  - andybak 6y ago
    Not sure I follow your reasoning here. The reason password managers make websites safer as opposed to apps is that the match the url and fill in the credentials automatically. If you are being phished, the urls won't match and the password manager will usually warn you if you try and force it to fill in the credentials. For a webview inside an app - they don't autofill anything and it's always manual - meaning the user has to be vigilant.
    - UncleMeat 6y ago
      > For a webview inside an app - they don't autofill anything and it's always manual - meaning the user has to be vigilant. But that has nothing to do with OAuth. A malicious app can already phish you by impersonating another app.

kerng 6y ago

Not just old apps, recently I saw Robinhood/BlockFi/othere use Plaid, and Plaid pops up a dialog to enter your bank account credentials! I'm not kidding. Of course there is a note that you dont have to worry and all is fine. Reminded me of Mint which did the same when I looked at it a few years ago. The financial system is so far behind tech wise its crazy, maybe even irresponsible.

Operyl 6y ago
At the very least, Plaid's finally getting official oauth2 integrations with a lot of the big banks. It'll be eons before we get such integrations with small banks, though. For example, Plaid now will open the banking app on a mobile device to continue authorization.

donmcronald 6y ago

> enter their username and password in any old app that throws up a webview And 2FA codes. And TOTP codes. From what I’ve seen users have been trained to enter credentials everywhere and constantly.