I know that there's not much to do about it, but these embedded web view OAuth dialogs always make me cringe. There's no URL bar, there's no SSL indicator, no way to check the certificate of the page it was hosted from.

It would be ever so easy to present a faked Google login page.

Of course, this is just a matter of trust and the issue would be the exact same if I were to just type my Google password into a native username/password form.

Still. What good is this OAuth stuff when it practically provides no security advantage over a traditional native UI? It's as easy for a malicious app to present me with a faked Google OAuth page as it is to just log whatever I type into the native UI which would have the advantage of being easier to use and not requiring any loading time.

OAuth is wonderful between webapps, but I really don't see justification for it with locally installed client apps.

If at all possible, please, please if you are forced to do the OAuth dance, try to make it go via the system default browser! THAT would allow me to check certificates and would be a huge security advantage over any traditional method.

Provided I can trust my browser, but frankly, I trust that much mor than $someapp_i_just_downloaded.