News for hackers. Stuff that matters.

A comment on Half of All Phishing Sites Now Have the Padlock. Parent comment

Re:Half of All Phishing Sites Now Have the Padlock by gwright on Wednesday November 28, 2018 @10:08PM (#18557714)
Sounds like you are talking about the OAuth authentication flow which is designed to use a separate window/iframe for entering credentials. This allows the application to authenticate the user without ever having access to the cleartext credentials.
[ Parent | on HN ]
Re:Half of All Phishing Sites Now Have the Padlock by crgwbr on Wednesday November 28, 2018 @11:24PM (#18558097)
That’s providing that the login page you enter your credentials in actually is Google/Facebook. The app can easily open a login page which looks identical, but actually submits your credentials somewhere nefarious.
[ Parent | on HN ]