Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it
One big problem with OAuth on mobile apps is this scenario. I've seen this in the wild for non security-critical apps. As far as I can tell, it's not a bug so much as it is a problem with the OAuth protocol and webview permissions:1) MyLittleApp wants OAuth access to BankOfMars2) MyLittleApp bundles BankOfMars SDK into MyLittleApp3) MyLittleApp requests oauth access via SDK4) SDK opens WebView for user to log into BankOfMars5) MyLittleApp has full control over the DOM presented to the user since the WebView is technically its own.6) MyLittleApp extracts the user's password from the DOM of the WebView7) MyLittleApp disappears and... profit?