A claimed HTTPS URI would tho, right? Odesláno z iPhonu
10. 9. 2019 v 19:22, Marius Scurtescu <[email protected]>: > If the phone is compromised, original app replaced by malicious app, then > RFC8252 will not help. The assumption is that the phone is not compromised. > >> On Tue, Sep 10, 2019 at 9:58 AM Masakazu OHTSUKA <[email protected]> >> wrote: >> Hi, >> >> I've read rfc8252 and have questions about native apps, that I couldn't find >> answers on Internet. >> >> Imagine an attacker doing: >> 1. original app and authorization server conforms to rfc8252 4.1. >> Authorization Flow for Native Apps Using the Browser >> 2. clone the original app, name it malicious app and install on the target >> phone >> 3. remove the original app from the target phone >> 4. use the malicious app and authorize, OS will invoke malicious app using >> custom URL scheme >> 5. now malicious app has access to the access token >> >> How should we think about this? >> What am I missing? >> >> _______________________________________________ >> OAuth mailing list >> [email protected] >> https://www.ietf.org/mailman/listinfo/oauth > _______________________________________________ > OAuth mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
