3

In the last few years, SSO protocols like OAuth and SAML are becoming increasingly used to enable 3rd parties access some user's resources from some service without the need for user to provide credentials to the 3rd party.

One such example are payment gateways:

  1. User selects a product he would like to buy
  2. User is redirected to the gateway page to enter his credit card details
  3. User is redirected back to the merchant website and the merchant gets the confirmation from the payment gateway that the transaction was successfull, without knowing user's credit card details

When a web brower is used, it's clear to me that I can be sure that I'm at a legitimate gateway page, by looking at name in the address bar and seeing that the certificate is ok(if I trust the payment gateway).

There are alo some merchant mobile apps that use SSO, by embedding the browser in the app to redirect user to the payment gateway. However, in those apps you don't see the address bar nor the gateway certificate. So, how can you be sure that you're entering your details in the payment gateway page instead of the merchant's app?

One such app that I saw is a local food ordering app.

EDIT: As @Anthony Russell pointed out you can use some tool to sniff the traffic and see what's really going on. If an app uses HTTPS you could use Burp/Zap/mitmproxy. If it uses SSL but not HTTPS, you could try to reverse engeneer the app but that would take more time.

Improve this question
2
  • In app? No, it's up to the creator to build that in. However, you could arp spoof the target and see what requests are going out. That's only a couple commands and would get you an answer quick.
    – DotNetRussell
    Jul 19, 2017 at 2:59
  • That's what I thought. I know that I can sniff the traffic to see what's going on. Maybe, I should add that to my question. I thought if there is an easy way for the user to knwo that he's not fooled. So, that's why Google dissalowed any "web view"(in-app-browser approach) and pushes you to use external browser instead(in this case the user can see the address and the lock icon, on Android he can also view the certificate, on ios default browser he can't, but he can still se if the certificate is valid by looking at the lock icon)
    – user3362334
    Jul 19, 2017 at 8:37

1 Answer 1

Reset to default
2

You cannot know, unless the native browser is shown. That's why Google disallowed any "web view" approach when authenticating against their OAuth2 system: https://developers.googleblog.com/2016/08/modernizing-oauth-interactions-in-native-apps.html

The RFC also recommends native browser in these cases: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-native-apps-12

OAuth 2.0 authorization requests from native apps should only be made through external user-agents, primarily the user's browser. This specification details the security and usability reasons why this is the case, and how native apps and authorization servers can implement this best practice.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .