4 ms·
Even if your api uses oAuth I don't see how can you prevent the client app to steal the password. At some point the user is going to have to give his password t
by dawkins 13y ago
Even if your api uses oAuth I don't see how can you prevent the client app to steal the password.
At some point the user is going to have to give his password to someone. Can't the app ask the user for his password, keep it, and internally give it to oAuth to allow to use your api?
- mmcnickle 13y agoThe user will enter their password on the provider's site via the phone browser. It relies on the user's trust of the system browser.
- dawkins 13y agoI meant for a native app and you being the provider. If you don't trust the client app even oAuth won't help you preventing the client app to know the user password.
- misterjangles 13y agoIt is true you have to trust that the native app is not tricking you into thinking that you're entering your password on Facebook. But, at least if it's implemented correctly and not maliciously, the app doesn't ever see your password.