23

How do I trust that I am typing my password for Google when I'm using a Safari web view in an any iOS app?

'Sign In' page, which appears to come from Google

5
  • Maybe we can extend this question to include all (mobile) OS? I'd be interested in a solution (if there is one) for android.
    – Nijin22
    Nov 6 '16 at 17:11
  • 1
    @Nijin22 The answer is different for Android, because the preferred login method is by invoking Google Sign-In which is part of Google Mobile Services.
    – oldmud0
    Nov 6 '16 at 19:31
  • 1
    See this image - google is going to block these from April 2017 i.stack.imgur.com/GdsQT.png
    – Tim
    Nov 29 '16 at 16:46
  • @Tim wow i didnt know my SE question would have such an effect on google jk .. way to go google! Nov 29 '16 at 16:48
  • @bubakazouba well it could have influenced their decision.
    – Tim
    Nov 29 '16 at 16:48
35

How do I trust that I am typing my password for google

You do not.

Apps should allow you to do that through actual Safari browser in another window, where you can see the address bar.

7
  • 7
    How do you know then that the app is opening an actual Safari window and not its own modified copy of the browser? Nov 6 '16 at 10:44
  • 5
    @FedericoPoloni double tap the home button. You should see two apps open, the app and Safari.
    – Tim
    Nov 6 '16 at 11:40
  • 2
    @Tim But then how do you know that that second app that looks a lot like Safari is Safari? Nov 6 '16 at 15:15
  • 4
    @FedericoPoloni well if it opens inside the app there would only be one app... so either the app has somehow installed a second app (not possible), or it really is safari. Also apps are labelled with their name and icon on the switcher.
    – Tim
    Nov 6 '16 at 15:22
  • 2
    @FedericoPoloni well yes, one app cannot install another, and no app in the store can be called safari. Names can change with an update, but I doubt safari could be installed
    – Tim
    Nov 6 '16 at 15:34
0

I agree with Greendrake.

With my experience with iOS you cannot verify if the source is from google or not, unless (like Greendrake said) it is in a browser window/interface.

However, if you have decent knowledge in reading packets then there is another solution. There are third party applications that will allow you to view the packets of your iPhone when it is tethered with your computer. From there you would be able to view if the authentication interface is from google or a third party.

5
  • 19
    Even if the content was retrieved from Google, and the password sent back properly, the application is in a man-in-the-middle- position, so it can save the password and leak it elsewhere. Nov 6 '16 at 7:13
  • You would only be able to see the IP addresses though as the connection between the app and the Google-looking website will be encrypted (HTTPS).
    – Greendrake
    Nov 6 '16 at 7:25
  • 1
    @Greendrake You could quite easily break into that tunnel. If you control the phone (to a certain extent), you can import a custom CA.
    – Rhymoid
    Nov 6 '16 at 12:39
  • @Koterpillar Very good point, but if you have control over the device you can inspect the app and check if it has any malicous content such as "abusive man-in-the-middle".
    – user121738
    Nov 6 '16 at 17:39
  • 1
    @milorules1012 if you can inspect the app, you can verify it's displaying the real Google page too. Nov 6 '16 at 21:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.