11 ms·
> Is that not a significant issue? No more an issue than normal. I don’t see how oauth makes it easier to phish. The attacker would need to have a fake or co
by dartos 2y ago
> Is that not a significant issue?
No more an issue than normal.
I don’t see how oauth makes it easier to phish.
The attacker would need to have a fake or compromised site send the victim to another fake site.
- rendaw 2y agoWithout oauth the user would type in their more limited per-site credentials, not their google creds or whatever. Splitting hairs if people reuse passwords, but I feel like "don't reuse passwords" is easier to digest for the layman than "check the ssl cert".
- dartos 2y agoany phishing email could just directly link to a fake Google login form. Oauth just adds extra steps for the attacker.