In the last few years, SSO protocols like OAuth and SAML are becoming increasingly used to enable 3rd parties access some user's resources from some service without the need for user to provide credentials to the 3rd party.
One such example are payment gateways:
- User selects a product he would like to buy
- User is redirected to the gateway page to enter his credit card details
- User is redirected back to the merchant website and the merchant gets the confirmation from the payment gateway that the transaction was successfull, without knowing user's credit card details
When a web brower is used, it's clear to me that I can be sure that I'm at a legitimate gateway page, by looking at name in the address bar and seeing that the certificate is ok(if I trust the payment gateway).
There are alo some merchant mobile apps that use SSO, by embedding the browser in the app to redirect user to the payment gateway. However, in those apps you don't see the address bar nor the gateway certificate. So, how can you be sure that you're entering your details in the payment gateway page instead of the merchant's app?
One such app that I saw is a local food ordering app.
EDIT: As @Anthony Russell pointed out you can use some tool to sniff the traffic and see what's really going on. If an app uses HTTPS you could use Burp/Zap/mitmproxy. If it uses SSL but not HTTPS, you could try to reverse engeneer the app but that would take more time.