When logging into web sites using federated login, it's easy to verify that the site that I'm entering my credentials into the site of the identity provider by looking at the address bar and ensuring that the certificate is valid.

In many apps, though, the credentials are asked for directly, in the app. While the likelihood that a youtube streaming app is trying to snag my credentials is low, it's still unnerving and I've been unwilling to log into these apps so far.

Assuming that the app is using the proper APIs, is there a good way to validate the security of the credentials form?

  • Please checkout how a secure chat application work, you will get the idea of mitigate some MiTM. As long as the app don't allow loading of unsecure third party script/modules, or contains serious issue like Signal messaging app flaw.
    – mootmoot
    May 18 '18 at 14:35
  • Hello mootmoot. Thank you for your comment, but I'm thinking of things more from a user's perspective. I've updated the title of the question to (hopefully) clear this up.
    – bshacklett
    May 18 '18 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.