I am talking about the apps that allow using my google account for login. Nothing against Postman, just using its login screen for example - enter image description here

My concern is that an app could be spoofing this whole screen to steal my credentials. Is 2FA/MFA good protection in this case? Is there any way to tell if this screen is not spoofed?

  • 1
    They don't need to spoof it. Apps aren't considered untrusted like websites are, so a malicious app could load the real Google login page inside of itself and steal your credentials from it anyway. – Joseph Sible-Reinstate Monica May 1 '19 at 19:04
  • 1
    if you have a malicious app running in your computer you got bigger problems than stolen credentials – Vipul Nair May 1 '19 at 20:12

It's called phishing, and no, 2FA doesn't prevent it in most cases (but you should still use 2FA). This sort of attack is why people recommend to always look at the browser's address bar before typing in a password (though that's had its own issues). When logging in through a local application though, you just have to trust that application to not steal your password. If you don't trust it, don't run it.

The only type of 2FA I'm aware of that can prevent this sort of attack is Webauthn and U2F, but this is only applicable when logging in through a trusted web browser. With a local application, all bets are off.

|improve this answer|||||
  • How can a local application gain access to the Google account if 2FA is enabled? – schroeder May 1 '19 at 19:12
  • @schroeder I'm assuming the local application would support logging in with 2FA, just as the legitimate login page would, and the user would enter their 2FA code / active their hardware token. – AndrolGenhald May 1 '19 at 19:13
  • You mean a passthrough form where the local app passes the user-entered code to the end service? – schroeder May 1 '19 at 19:14
  • Basically that, yeah. – AndrolGenhald May 1 '19 at 19:14
  • 2
    @defalt And that doesn't help one bit if the attacker uses their own implementation that spoofs a normal browser's user agent. – AndrolGenhald May 1 '19 at 23:44

You are absolutely correct that this is a security concern.

RFC 6749 - The OAuth 2.0 Authorization Framework (which this "login with Google" system is) describes this problem in section 9:

An embedded user-agent poses a security challenge because resource owners are authenticating in an unidentified window without access to the visual protections found in most external user-agents. An embedded user-agent educates end-users to trust unidentified requests for authentication (making phishing attacks easier to execute).

So the correct way from a developer's perspective would be to use the user's browser directly (and not embedding it). There are also some more benefits, also explained in section 9.

Unfortunately, this doesn't always happen in practice and for most users it is impossible to detect a well-made phishing screen here, as the developer of the native app (in this case: Postman) could simply proxy the real login screen through while storing the authentication cookie. Not even 2FA would help in that case.

You should evaluate if you trust the developer of that application enough or ideally ask them to fix their login method.

|improve this answer|||||

A fake login screen is the first major social engineering attempts made long ago when the web was young and it still persists as an effective route to gaining people's credentials. That's what phishing is, to a large extent.

So, yes, 2FA/MFA is the response to this threat and is a big reason why 2FA/MFA exists. Always enable 2FA when you can.

You would have to look at the code and what the source was of the login screen to determine if it was legitimate, if the screen was not obviously faked (which is difficult to do).

|improve this answer|||||
  • 4
    Inside a fake app you can presumably load the genuine login page and steal directly from the fields. Am not sure if embedded Chromium (or equivalents) block this. – David May 1 '19 at 19:29
  • I am unsure how this answer differs from Androl's answer. – schroeder May 2 '19 at 10:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.