3 ms·
Not sure I follow your reasoning here. The reason password managers make websites safer as opposed to apps is that the match the url and fill in the credential
by andybak 6y ago
Not sure I follow your reasoning here.
The reason password managers make websites safer as opposed to apps is that the match the url and fill in the credentials automatically. If you are being phished, the urls won't match and the password manager will usually warn you if you try and force it to fill in the credentials.
For a webview inside an app - they don't autofill anything and it's always manual - meaning the user has to be vigilant.
- UncleMeat 6y ago> For a webview inside an app - they don't autofill anything and it's always manual - meaning the user has to be vigilant. But that has nothing to do with OAuth. A malicious app can already phish you by impersonating another app.
- andybak 6y ago> A malicious app can already phish you by impersonating another app. Yes but that requires a host of other things to go wrong first. My point is basically "Don't enter your credentials into any app". There might be exceptions for 1st party apps but these are much less common and the OS already has protections in place (of varying levels of effectiveness).