3 ms·

> Launch the user's browser where there is a slightly higher chance that they will be able to spot that things aren't legit. Some sites allow and encourage the

by jt2190 6y ago

> Launch the user's browser where there is a slightly higher chance that they will be able to spot that things aren't legit. Some sites allow and encourage the user to customize their login page. The attacker the must reproduce the unique login page for each user.

andybak 6y ago
At that point they have already entered their credentials. Unless I'm misunderstanding you? The webview is equivalent to "show the login page in a sandboxed browser" - there is no memory of any customization.
- tsimionescu 6y ago
  Usually this happens after you enter your username/email but before the password. It's very common with company logins - you first want to login to Azure, you get redirected to login.microsoft.com, you enter your company email, you get transfered to your company's login.company.com page. The same can be done with a personal login page.
  - andybak 6y ago
    I've personally never seen this with any "in-app" oAuth page. I don't think it changes my fundamental point.
vladvasiliu 6y ago
But how much of a hurdle is that? The login page is likely accessible by the attacker, who can then copy it. Sure, it's a bit more work than setting up a random HTML form, but if you're already running a somewhat targeted attack it may be worth it. It's also not clear to me why the apps don't launch the system browser. The IntelliJ IDEs do this. Added bonus is the sign-on is actually... single, since I'm probably already logged in to the service. Even a command-line tool, awscli, is able to figure out how to launch a browser, use whatever session is active, populate the device code on the form, etc. All I have to do is click the button "yup, I actually asked for this happen". And this is running on Linux without a fancy DE or anything. MS Teams however, does it in its own browser, restarts five times, etc. It seems to me that this idea of simplification (the user doesn't even have to switch apps!) has been pushed too far, to the point of actually making things more complicated for the user and in the process decreasing security.
elliekelly 6y ago
When I log in to my bank I recognize the little icon I chose but I’m not sure I’d notice its absence. I suspect I wouldn’t.

by jt2190 6y ago

andybak 6y ago

At that point they have already entered their credentials. Unless I'm misunderstanding you? The webview is equivalent to "show the login page in a sandboxed browser" - there is no memory of any customization.

tsimionescu 6y ago
Usually this happens after you enter your username/email but before the password. It's very common with company logins - you first want to login to Azure, you get redirected to login.microsoft.com, you enter your company email, you get transfered to your company's login.company.com page. The same can be done with a personal login page.
- andybak 6y ago
  I've personally never seen this with any "in-app" oAuth page. I don't think it changes my fundamental point.

vladvasiliu 6y ago

But how much of a hurdle is that? The login page is likely accessible by the attacker, who can then copy it. Sure, it's a bit more work than setting up a random HTML form, but if you're already running a somewhat targeted attack it may be worth it. It's also not clear to me why the apps don't launch the system browser. The IntelliJ IDEs do this. Added bonus is the sign-on is actually... single, since I'm probably already logged in to the service. Even a command-line tool, awscli, is able to figure out how to launch a browser, use whatever session is active, populate the device code on the form, etc. All I have to do is click the button "yup, I actually asked for this happen". And this is running on Linux without a fancy DE or anything. MS Teams however, does it in its own browser, restarts five times, etc. It seems to me that this idea of simplification (the user doesn't even have to switch apps!) has been pushed too far, to the point of actually making things more complicated for the user and in the process decreasing security.

elliekelly 6y ago

When I log in to my bank I recognize the little icon I chose but I’m not sure I’d notice its absence. I suspect I wouldn’t.