There is no technical limitation to an app engaging in very nefarious activity. For example an app could modify the DOM on the sign-in screen to grab your password after you enter it. Of course the accountability of MITM and security reviews might mitigate this risk, but passwords are generally only a few bytes and could easily be obfuscated and passed surreptitiously over the wire.
I've seen a (quite popular) app implement this for facebook invitations, which should only have a limit of 50 friends, to secretly (in the background, without any action on your behalf other than logging in, or perhaps pressing a "continue" button) invite every one of your friends to download the app. Since facebook does not notify you when you send an inviation, you would not even know the app did this unless one of your friends who you invited asked you about it.
[0] https://news.ycombinator.com/item?id=11637209 (thanks molecule)
Some providers (e.g. Fitbit) require you use this instead of UIWebView in order to access their API, presumably to avoid accessing the DOM.
Not sure exactly how they are enforcing this though, since they don't provide their own OAuth library.
The comment's timestamp is a link.
Uh, seriously? I just suggested to our mobile team to integrate this way on Android (I implemented the OAuth 2 server).
I would've made the same suggestion to a 3rd party app vendor when the day comes.
I'm curious how exactly this is specific to the UIWebView implementation.
The OAuth model not only enables phishing directly even worse than that, it disarms people's natural skepticism towards phishing attempts. Its adoption was a terrible idea.
Of course, you're absolutely right that it would be trivial to spoof, say, Google or Facebook or Twitter and collect credentials. I would _hope_ that behavior would be detected by Apple or Google during app security screening, but maybe not. Regardless, I totally agree with you about OAuth and security. It does present a lot of problems.
I have a certificate signed by Symantec guaranteeing that it's authentic!
Outside of the Android model where it does the auth for you upon request and only hands the app a token, I don't really see how you don't open yourself to this attack.
iOS really doesn't provide a way for other vendors in an inner ring of consumer trust and power to deal with this. While I'm not a fan of the decision to give full access to Pokemon Go, I didn't find it surprising that it did so on iOS and I had to make a conscious decision to "trust" Pokemon Go as part of the process.
If UIWebView didn't allow the app access to the DOM then it wouldn't be possible this way. But,of course, the user has no way to know how the UI is implemented.
I'm really glad you're not making that decision then. Banning some company based on their use of public, legal APIs would be an absolutely toxic decision for Google's platform.
It's Google's fault for allowing this kind of access with no notification (yes, the fault here might lie somewhere in OAuth, but there's plenty that Google could do to make this less serious). Don't blame people for leveraging options at their disposal.
I've yet to see it confirmed, though.
https://developers.google.com/identity/protocols/OAuth2Insta...
Which probably isn't very helpful, as lots of users won't notice whether they are using a browser or not.
Does anybody know how Pokemon Go ends up interacting with accounts that have 2 factor authentication turned on? I sure wouldn't type my main password into some app, I'd at least use an app password:
After I disconnected it, it didn't behave that way a second time. So I am kinda mystified what happened there. But it was pretty strange.
Is that the case? Doesn't this still require going through the standard prompts?
"Pokemon Go Release - Has full access to your Google account"
Revoking access now. Glad I read HN!
In my dream world Google would revoke Niantic's API access forever in order to make an example out of them. Maybe, eventually, if they can prove that they didn't hoover up all the information they had access to they can be unbanned after a year.
Unlikely though considering they used to be a part of Google.