Recent searches
Search options
@krosylight@fosstodon.orgLooking at #IndieAuth. It uses URL as the client identifier, but what if a fake native app steals the URL of another app? How can the user know whether the URL is genuinely linked to the app in their hand? Does someone have an answer? #indieweb #security https://github.com/indieweb/indieauth/issues/121
This is interesting, Google just blocks the flow from webviews. Now I wonder there's a convenient list of user agent strings of such web views. https://github.com/MicrosoftEdge/WebView2Feedback/issues/171#issuecomment-846480724
(And what if one forces the webview to use the system browser-ish user agent string?)
@krosylight Aaaaaah, I don't like this. This concerns portier.io as well. Why is it even possible to hijack a domain like that? I thought iOS did a HTTP probe and requires a specific response? But no idea about other platforms.
@kosinus Yeah this Windows API is suspicious, but I guess any random webview can implement the similar procedure as platforms support doing random things with webviews. And I don't think there's an easy way to block webviews from the auth flow...