4 ms·

And what is the difference between an untrusted application presenting a login webview for your service of choice, and a GUI form doing the same? I must not un

And what is the difference between an untrusted application presenting a login webview for your service of choice, and a GUI form doing the same? I must not understand the article.

nostrademons 13y ago
Do native apps really use third-party authentication services? That would scare the shit out of me too. I think the point of the article is that there's a trend with web applications to use third-party identity providers like Google or Facebook. This itself is (mostly) harmless; their login procedures are designed so that you can verify that it is, in fact, Google or Facebook you are logging into, because the login form is hosted on their domain, it goes through SSL, and you can verify all that in the browser's address bar. There's also a trend toward eliminating the address bar, by eg. putting your webapp in a WebView which doesn't show it, or by using native-only apps, or Chrome's move toward not showing the full URL for certain sites. When you combine this with the trend toward third-party identity providers, it's very dangerous, because you have no way of verifying that you are giving your identity to the people you think you are giving your identity to.
- swdunlop 13y ago
  > Do native apps really use third-party authentication services? That would scare the shit out of me too. I would not underestimate the callousness of someone chasing revenue one or two dollars at a time. I see this all the time in Android applications, digging around with AndBug [1] -- just set a hook on various apache.http.client.HttpClient methods, and watch the interactions. [1]: https://github.com/swdunlop/andbug https://github.com/swdunlop/andbug
leokun 13y ago
You as the user can't tell if the webview is using the HTTPS protocol to request data. You don't have to be a target of the NSA to care about this. If you're at a wifi hotspot with your mobile phone, like at the airport, you can see the clear text requests others on the wifi network are making. You can see what a form posts to when you submit it in the URL. Browsers will warn you when there is non HTTPS data loaded on an HTTPS page.
- chc 13y ago
  Are native app forms any better in this regard?
  - hodgesmr 13y ago
    At least native app forms don't look so much like the authentic website. Harder to phish, but still possible I suppose.
  - plorkyeran 13y ago
    They're no more secure, but from a certain perspective they're more honest. I suspect there's a decent number of users that will never consider that the app could trivially get their password if the login screen looks like the website's login screen, but would if it looks like the app.
deleted 13y ago
[deleted]

And what is the difference between an untrusted application presenting a login webview for your service of choice, and a GUI form doing the same? I must not understand the article.

nostrademons 13y ago

Do native apps really use third-party authentication services? That would scare the shit out of me too. I think the point of the article is that there's a trend with web applications to use third-party identity providers like Google or Facebook. This itself is (mostly) harmless; their login procedures are designed so that you can verify that it is, in fact, Google or Facebook you are logging into, because the login form is hosted on their domain, it goes through SSL, and you can verify all that in the browser's address bar. There's also a trend toward eliminating the address bar, by eg. putting your webapp in a WebView which doesn't show it, or by using native-only apps, or Chrome's move toward not showing the full URL for certain sites. When you combine this with the trend toward third-party identity providers, it's very dangerous, because you have no way of verifying that you are giving your identity to the people you think you are giving your identity to.

swdunlop 13y ago
> Do native apps really use third-party authentication services? That would scare the shit out of me too. I would not underestimate the callousness of someone chasing revenue one or two dollars at a time. I see this all the time in Android applications, digging around with AndBug [1] -- just set a hook on various apache.http.client.HttpClient methods, and watch the interactions. [1]: https://github.com/swdunlop/andbug https://github.com/swdunlop/andbug

leokun 13y ago

You as the user can't tell if the webview is using the HTTPS protocol to request data. You don't have to be a target of the NSA to care about this. If you're at a wifi hotspot with your mobile phone, like at the airport, you can see the clear text requests others on the wifi network are making. You can see what a form posts to when you submit it in the URL. Browsers will warn you when there is non HTTPS data loaded on an HTTPS page.

chc 13y ago
Are native app forms any better in this regard?
- hodgesmr 13y ago
  At least native app forms don't look so much like the authentic website. Harder to phish, but still possible I suppose.
- plorkyeran 13y ago
  They're no more secure, but from a certain perspective they're more honest. I suspect there's a decent number of users that will never consider that the app could trivially get their password if the login screen looks like the website's login screen, but would if it looks like the app.

deleted 13y ago

[deleted]