0

I've been thinking about Oauth login which works wonderfully for websites in general.

However these login types are becoming more prevalent in apps, both desktop and mobile. In these situations often the challenge page from the third party is displayed in an in app window, not a browser.

In these cases the hosting application could definitely fake the third parties challenge page to steal the users credentials.

Are there any best practices or systems in place to prevent this?

2

There is an RFC specifically adressing oauth2 in native apps: https://tools.ietf.org/html/rfc8252

It advises that the app uses the OS browser (Safari / Chrome) rather than show the login window in a web view or handling the credentials in the app.

But in this it largely aims to train the user in what a login is supposed to look like, rather than to provide specific controls to prevent the app from misbehaving.

  • 1
    Thanks, this is the answer. Basically a lot of apps aren’t following best practice. Btw you stated that this rfc is for mobile, but it seems to be for native apps in general so actually more relevant to my question. – Ian Newson Oct 15 '18 at 4:28
0

Normally on desktop or mobile application if you already have logged in and have a session you won't be asked for a password, you just need to select an account/user. This normally happens with social login like Facebook and Google.

On desktop websites the new window still displays the URL that tries to connect, you just need to be careful and look into that if you don't have a session (already logged in, like Google/Facebook).

There is some cases like OSX Mail application, that integrate Google authentication directly into their app, without a way for you to confirm that is really a page from google and not a malicious page. In this cases the only way is to trust the app.

If you have an unique password for each social login, having 2FA authentication can put a very strong barrier in case you type your password into a malicious website/app.

  • Thanks, I don’t think the first bit is quite true. This has occurred to me a few times in different apps, but this time was while using one called Stagelight for the first time. You will already be logged in if the app can use a web browser implementation that shares other session data. I think this is common on mobile but not on desktop. – Ian Newson Oct 14 '18 at 23:11
  • Oops, posted too soon. Yes, in the browser you can see the URL which is fine, but my question is specifically in apps where there is no browser chrome. If you know what you’re doing you can still verify the hosted web page came from the right place, but that’s out of reach of the average user. – Ian Newson Oct 14 '18 at 23:12
  • 1
    2FA helps but doesn’t solve the problem as it just makes it harder, not impossible. – Ian Newson Oct 14 '18 at 23:13
  • I've use Android mobile phone, and I've tested in some apps that implement social login (Google and/or Facebook) and they don't request me to input my password. Even apps that I never use before. So, in principle, if you have already logged in into a Google App (probably Gmail) and Facebook, you will not need to input your password. If you never logged in, you will be asked to input a password. I've setup a new android phone a couple of weeks ago, and when I tried to use social login without Facebook user, it asked for the password. Probably can exists some cases where password might be asked. – David Magalhães Oct 14 '18 at 23:17
  • Yes, that’s common on mobile although not enforced. On desktop it’s not common. I can’t think of an app which implements on Windows. – Ian Newson Oct 14 '18 at 23:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.