Subject: Re: [OAUTH-WG] OAuth 2 for Native Apps

From: Torsten Lodderstedt <[email-masked]>
Date: Fri, 02 Jul 2010 00:06:11 +0200

you are right. So the only trustworthy way to enter credentials is an 
external browser?

regards,
Torsten.

Am 28.06.2010 20:11, schrieb Marius Scurtescu:
> On Fri, Jun 25, 2010 at 10:33 PM, Torsten Lodderstedt
> <[email-masked]>  wrote:
>    
>> comment/question regarding the Embedded Browser scenario: Is the URL bar and
>> SSL verification symbols (lock + green bar) visible in that scenario?
>> Otherwise, the user has no chance to verify the identity of the IDP/OAuth
>> server. So there might be problems regarding password phishing .
>>      
> AFAIK the URL bar is not visible.
>
> Who would phish the end user? If it is the native app, then all bets
> are off regardless, the native app can show a fake address bar if it
> really wants.
>
> Marius
>
>
>    
>> regards,
>> Torsten.
>>
>> Am 22.06.2010 02:54, schrieb Marius Scurtescu:
>>      
>>> Here is the wiki page: http://wiki.oauth.net/OAuth-2-for-Native-Apps
>>>
>>> Feel free to edit or comment.
>>>
>>> Marius
>>>
>>>
>>>
>>> On Wed, Jun 9, 2010 at 10:59 AM, David Recordon<[email-masked]>
>>>   wrote:
>>>
>>>        
>>>> Want to put this on the wiki http://wiki.oauth.net/?
>>>>
>>>>
>>>> On Mon, Jun 7, 2010 at 12:25 PM, Marius Scurtescu<[email-masked]>
>>>>   wrote:
>>>>
>>>>          
>>>>> Hi,
>>>>>
>>>>> I attached a document that summaries how native applications can use
>>>>> OAuth 2.
>>>>>
>>>>> Feedback more than welcome, especially if you have experience with
>>>>> native apps and OAuth.
>>>>>
>>>>> The current Web Server and Device flows need small changes and
>>>>> clarifications in order to properly support native apps, I will start
>>>>> a separate thread on that.
>>>>>
>>>>> Marius
>>>>>
>>>>> _______________________________________________
>>>>> OAuth mailing list
>>>>> [email-masked]
>>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>>
>>>>>
>>>>>
>>>>>            
>>>>
>>>>          
>>> _______________________________________________
>>> OAuth mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/oauth
>>>
>>>        
>>
>>