Hacker News Reader

Comment by dn3500 | Hacker News Reader

Does this mean Google is explicitly repudiating web standards and refusing to interoperate with any browsers except the ones they approve? Or is there more to it than that?

View on HN

Quite the opposite actually. OAuth is designed to broker token exchange between two services in a standards-compliant web browser. Apps have increasingly been getting around it by embedding browser shells in their own interface, making the process less transparent for the end user. This opens users to all kinds of phishing attacks (e.g. an app might show you a Google sign-in page which is actually hosted on their own server, or steal your credentials even if you are actually on google.com, or automatically click "approve" without any user feedback etc.)

Enforcing that OAuth is handled in a browser controlled directly by the OS is the right thing to do.

> an app might show you a Google sign-in page which is actually hosted on their own server, or steal your credentials even if you are actually on google.com

I'm confused, how does "this browser is not supported" translate into "this request is coming from a third party server"? Can't a third party just use whatever browser is supported to send the request?

The idea is that users should not be expected to or used to entering their Google credentials outside of a browser they don't fully trust.

> entering their Google credentials outside a browser Google doesn’t fully trust

FIFY

As the user, I fully trust my Epiphany browser.

No, this means that Google demands that apps use the default browser you've set for login instead of the builtin WebKit of the device.

And what if your default web browser is Epiphany?

The user you asked has apparently decided to pretend that particular reality doesn't exist.

Reply on news.ycombinator.com