I've noticed a trend in mobile and desktop apps in recent years with the advent of OAuth (and it may also affect other frameworks) to request a user to sign up or log in using 3rd party authentication providers, usually social accounts like Twitter, Facebook or Google. The problem comes when I can't trust the app I'm entering the credentials in, because the developer has embedded a browser in a dialog/window owned by the app, and I have no way to know if the page I'm seeing is a legitimate login page, or that the user agent (browser and layers on top) can be trusted.
I'm not talking about apps from small indie devs either, I'm talking software by widely trusted companies (at least in the software development community where I spend most of my time). Some examples that I've seen in the last few weeks:
- Atlassian Sourcetree allows you to log in using your Google account - in an Atlassian window
- Postman Google login occurs in a Postman window
- Microsoft Visual Studio and Office do it with your Microsoft Account (granted, this is trusted a bit more as the app is owned by the auth provider, but it still endorses the process)
- Some apps ask you to, for example, log into Paypal in a browser window inside their app
Similar questions asked in the past regarding mobile apps (but the problem is not limited to mobile):
One question related to a desktop app:
And tangentially related is the use of iframes in web applications:
This is an issue of trust for me when moving from app space to the web to authenticate, get a token and return back to the app. I might trust the companies enough to install their software, but not enough to enter the master keys to my Google account (for all intents and purposes) into their software.
In researching this question further I found this IETF draft which states:
Embedded user-agents are an alternative method for authorization native apps. They are however unsafe for use by third-parties to the authorization server by definition, as the app that hosts the embedded user-agent can access the user's full authentication credential, not just the OAuth authorization grant that was intended for the app.
EDIT: The draft above became RFC8252, dated October 2017, thanks to @Geir for directing me to that.
and an older directive, RFC6749 (dated October 2012) which also mentions among other interesting tidbits:
An embedded user-agent poses a security challenge because resource owners are authenticating in an unidentified window without access to the visual protections found in most external user-agents. An embedded user-agent educates end-users to trust unidentified requests for authentication (making phishing attacks easier to execute).
Am I right to be concerned that this is a growing opportunity for phishing and MITM attacks (fake or hijacked browser in the middle which steals credentials and/or tokens in real time, also defeating 2FA)? Not so much that trusted software itself is likely to be made malicious, but that widespread usage discourages users from verifying end-to-end trust, condoning (even encouraging) users to blindly enter credentials into any app that asks for them?
I think the last section quoted above answers undeniably in the affirmative, but I'm interested in further comments and perspective around this, particularly as a software developer myself.
The obvious "correct" way to do it is to forward the user to their trusted browser for authentication instead, however this can be a poor user experience, and doesn't actually fix the problem (a malicious developer could open a window from the main app that looks like Chrome, but isn't - the fact user sessions from the main browser window are not preserved, among other visual cues would probably go unnoticed by most).
Is there a better way to design the user experience of apps such that a user can be sure they are using a trusted software stack (app and rendering engine), in-app? Should there be device- or system-level handling of such auth requests in a way that's hard to mimic?
I'm not really involved in the security scene, just a lurker here, is this a well known concern in the industry? Are there efforts to curb this sort of authentication flow?