Let's take a look at the basic OAuth workflow:
The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each time the app wants a new access key.
The real problem here is that the service doesn't know much about the consumer. In the case when a mobile app is a consumer, it doesn't even know its URL.
So when the grant access page appears, the service doesn't know who really wants access. So the user gets confused.
What is the solution to this problem?
In the case of a web app, preshared private keys could be used. But it isn't an option for a mobile app (since it is impossible to hide the private key).
Is it really a security threat? I suppose, the user should know from the context which app has requested access. But why then so many websites require a "secret" key? (which isn't really a secret when a mobile app is involved)
Probably, I wasn't clear enough. Let's try again. Here's an explaining picture:
As you can see, it's the user who should make sure the proper app gets access.
But the message "I don't know who tries to access the service", while being precise, is very confusing.
Is there a technique to identify the app reliably?