3 ms·
> the population of people who would be fooled by phishing That population includes me. I'm in danger of being phished by 3rd party apps. > People are awful a
by andybak 6y ago
> the population of people who would be fooled by phishing
That population includes me. I'm in danger of being phished by 3rd party apps.
> People are awful at recognizing phishing. Straight up.
Yes - which is why password managers are a key part of the solution. They match on URLs and require an extra step to bypass.
- UncleMeat 6y agoPassword managers can autofill the OAuth page just fine. Wouldn't that mean that there is no problem with OAuth making phishing more dangerous?
- andybak 6y agoNot sure I follow your reasoning here. The reason password managers make websites safer as opposed to apps is that the match the url and fill in the credentials automatically. If you are being phished, the urls won't match and the password manager will usually warn you if you try and force it to fill in the credentials. For a webview inside an app - they don't autofill anything and it's always manual - meaning the user has to be vigilant.
- UncleMeat 6y ago> For a webview inside an app - they don't autofill anything and it's always manual - meaning the user has to be vigilant. But that has nothing to do with OAuth. A malicious app can already phish you by impersonating another app.
- andybak 6y ago> A malicious app can already phish you by impersonating another app. Yes but that requires a host of other things to go wrong first. My point is basically "Don't enter your credentials into any app". There might be exceptions for 1st party apps but these are much less common and the OS already has protections in place (of varying levels of effectiveness).