Re: [OAUTH-WG] Public client cloning

A claimed HTTPS URI would tho, right?

Odesláno z iPhonu

10. 9. 2019 v 19:22, Marius Scurtescu <marius.scurtescu=40coinbase.com@dmarc.ietf.org>:

> If the phone is compromised, original app replaced by malicious app, then RFC8252 will not help. The assumption is that the phone is not compromised.
> 
>> On Tue, Sep 10, 2019 at 9:58 AM Masakazu OHTSUKA <o.masakazu@gmail.com> wrote:
>> Hi,
>> 
>> I've read rfc8252 and have questions about native apps, that I couldn't find answers on Internet.
>> 
>> Imagine an attacker doing:
>> 1. original app and authorization server conforms to rfc8252 4.1.  Authorization Flow for Native Apps Using the Browser
>> 2. clone the original app, name it malicious app and install on the target phone
>> 3. remove the original app from the target phone
>> 4. use the malicious app and authorize, OS will invoke malicious app using custom URL scheme
>> 5. now malicious app has access to the access token
>> 
>> How should we think about this?
>> What am I missing?
>> 
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth