Is this dark magic? :) How does it do oauth without a domain? If you build an apk for Android how does the authentication step grant your app an oauth token?

Does it use a shared firebase server to grant access? If so, how is that secure between unrelated firebase apps?

I tried the demo but it didn't work when running file://.../index.html. The login buttons did nothing.

I guess it would use a provided intermediate server like the one Facebook offers: https://developers.facebook.com/docs/howtos/login/login-for-...

couldn't this be done in the first place already?

I thought firebase supported html5 a long time ago.

Is it the websocket part that couldn't be ported to Phonegap?

While Firebase largely worked in PhoneGap prior to the latest releases, there were a few outstanding bugs specific to PhoneGap deployments that required special handling or attention, though websockets were not directly affected. As a sample, we had some previous errors around long-polling and creating iframes (used as a fallback when websockets fail) in PhoneGap, and most notably Firebase Simple Login was entirely unsupported in PhoneGap applications until this latest release.