I cringe every time I am prompted with OAuth in an app because of the lack of ability to verify that the page is actually originating from the represented source.
Are most app OAuth implementations exposing vulnerability because of obscured URL/origin?
Below are OSX and iOS apps... a web view (embedded web browser viewport without address bar) is created and the OAuth page is displayed without URL or SSL certificate - which could be easily spoofed and exploited with phishing techniques. The risk seems huge.
Cobook App on OSX
Trello App on iOS