Hacker News Reader

I haven't worked much with OAuth on the iPhone, but what I hate is that, when it's embedded in apps, it makes phishing attempts pretty much undetectable for end users. I see a Facebook login form pop up in a UIWebView in an app - is it really Facebook, or is it some other site? I have no way of knowing.

View on HN

There was a big thread on the OAuth mailing list about this a couple of months ago. The official response seems to be "don't use native applications that you think might phish you", which isn't very satisfying.

I'm not sure what the alternative is, though, and OAuth is still a big improvement for the web app client use case.

Reply on news.ycombinator.com