Starting January 4 Google will block sign-ins from embedded browser frameworks

Re:Starting January 4 Google will block sign-ins from embedd... by gruez on Thursday November 19, 2020 @07:14PM (#25155997)

>It's much, much safer, because the app can't see or hijack the login process - it doesn't get access to the login form and can't phish you with it.

Not really. On non-sandboxed platforms (eg. windows or mac) it does nothing because the program already has full access to the operating system. It could very keylog the password as it's being entered into the "real" browser. Regardless of whether it's sandboxed, it could also launch a phoney "real" browser (ie. custom build of firefox/chrome that has keylogging logic built into the browser itself), and keylog using that. I'm not sure how that can be detected.

[ Parent | on HN ]

[dead]

Re:Starting January 4 Google will block sign-ins from embedd... by Wowfunhappy on Thursday November 19, 2020 @07:49PM (#25156232)

I think you're talking about different things. On Windows and most Linux variations, the program could install a keylogger and monitor what you type into a web browser. The browser may be sandboxed, but the malicious program you're logging into is not.

macOS might be a little more secure post-Catalina; the user would have to grant additional permissions to the malicious app. Of course, a lot of apps legitimately need those permissions, so it wouldn't be so odd to request them.

[ Parent | on HN ]