Hackers use OAuth, fake Google apps to phish users

pcworld.com

7 pointswillow98864 comments

Relatedly, be very careful which apps with "native browsers" you enter 3rd party credentials into. For example if you install an app and it opens a WebView with the google login screen, the app can read and write any arbitrary content to and from the DOM in the WebView.

Not sure about android but this is definitely possible on iOS.

Good point. Web views are no good. Google has introduced the new app auth libraries (for iOS and android) which are more secure.

My business partner wrote a blog about this topic: https://www.linkedin.com/pulse/webviews-bad-use-appauth-mike...

Note that web view oauth logins to Google are disabled since 20th of April:

> On April 20, 2017, we will start blocking OAuth requests using web-views for all OAuth clients on platforms where viable alternatives exist.

Source: https://developers.googleblog.com/2016/08/modernizing-oauth-...

I'm honestly surprised it took them that long to abuse OAuth.

Reply on news.ycombinator.com