News for hackers. Stuff that matters.

A comment on Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it. Parent comment

Re:Introducing TAuth: Why OAuth 2.0 is bad for banking APIs ... by habosa on Thursday May 05, 2016 @01:42PM (#11638196)
This is why the OAuth Identity Providers that take security most seriously do not allow WebView login (or at least provide an SDK where you don't need it).
[ Parent | on HN ]
Re:Introducing TAuth: Why OAuth 2.0 is bad for banking APIs ... by EGreg on Thursday May 05, 2016 @03:21PM (#11638980)
How exactly do you prevent a user agent WebView in an app from spoofing iOS Safari?
[ Parent | on HN ]
Re:Introducing TAuth: Why OAuth 2.0 is bad for banking APIs ... by habosa on Thursday May 05, 2016 @03:37PM (#11639090)
It's very hard to do but you can at least make your SDK do a fast app switch to safar rather than use a WebView. Of course evil apps can find a way around it like you said but at least you can make your SDK and Documentation point the right way,

I am not experienced with iOS but I also suspect there are more advanced WebView detection tricks. It also doesn't help that Apple really doesn't like fast app switching.

[ Parent | on HN ]
Re:Introducing TAuth: Why OAuth 2.0 is bad for banking APIs ... by blazespin on Thursday May 05, 2016 @05:15PM (#11639707)
you email the authn link to the user rather than use openurl
[ Parent | on HN ]