News for hackers. Stuff that matters.

A comment on W3C Proposes the Creation of a WebView Community Group. Parent comment

Re:W3C Proposes the Creation of a WebView Community Group by mleo on Wednesday May 11, 2022 @09:27AM (#31339635)
The VPN software we used was configured one day to start presenting web view for oauth sign-in with no announcements this would change. The view had no navigation bar. Could not right click and get properties. No way to verify that what was loaded was secure or valid. Whether any of that could be trusted is additional question, but yes, some presentations of web views are terrible.
[ Parent | on HN ]
Re:W3C Proposes the Creation of a WebView Community Group by aaaaaaaaata on Wednesday May 11, 2022 @09:35AM (#31339726)
> No way to verify that what was loaded was secure or valid.

Signed software from your VPN provider isn't enough?

What type of attack, theoretical or otherwise, are you avoiding?

[ Parent | on HN ]
Re:W3C Proposes the Creation of a WebView Community Group by johannes1234321 on Wednesday May 11, 2022 @12:27PM (#31342201)
An Oauth request loads an external website. A Network-Level attacker anywhere on the path might try to send the request elsewhere.
[ Parent | on HN ]