But how much of a hurdle is that? The login page is likely accessible by the attacker, who can then copy it. Sure, it's a bit more work than setting up a rando

But how much of a hurdle is that? The login page is likely accessible by the attacker, who can then copy it. Sure, it's a bit more work than setting up a random HTML form, but if you're already running a somewhat targeted attack it may be worth it. It's also not clear to me why the apps don't launch the system browser. The IntelliJ IDEs do this. Added bonus is the sign-on is actually... single, since I'm probably already logged in to the service. Even a command-line tool, awscli, is able to figure out how to launch a browser, use whatever session is active, populate the device code on the form, etc. All I have to do is click the button "yup, I actually asked for this happen". And this is running on Linux without a fancy DE or anything. MS Teams however, does it in its own browser, restarts five times, etc. It seems to me that this idea of simplification (the user doesn't even have to switch apps!) has been pushed too far, to the point of actually making things more complicated for the user and in the process decreasing security.