Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it
One big problem with OAuth on mobile apps is this scenario. I've seen this in the wild for non security-critical apps. As far as I can tell, it's not a bug so much as it is a problem with the OAuth protocol and webview permissions:<p>1) MyLittleApp wants OAuth access to BankOfMars<p>2) MyLittleApp bundles BankOfMars SDK into MyLittleApp<p>3) MyLittleApp requests oauth access via SDK<p>4) SDK opens WebView for user to log into BankOfMars<p>5) MyLittleApp has full control over the DOM presented to the user since the WebView is technically its own.<p>6) MyLittleApp extracts the user's password from the DOM of the WebView<p>7) MyLittleApp disappears and... profit?