Re: [OAUTH-WG] Android App Links (AKA Universal Links)

Hi Dick

I didn’t attend the call so don’t know the background of this and the exact situation, but the general problem is mostly where the Authorization Server’s app is *not* installed. In that case Android falls back to much weaker mechanisms that allow other apps to get a look in. App links also aren’t consistently supported across all commonly used android browsers which causes further problems.

In general to do app2app oauth redirections securely on Android it’s necessary for both apps to fetch the /.well-known/assetlinks.json for the url they want to redirect to, and verify that the intent the app intends to launch to handle the url is signed using the expected certificate. Web2app flows are trickier, on both iOS and on Android. There were lengthy discussions on at least the Android case at OAuth Security Workshop this year (recordings available).

Joseph

> On 20 Oct 2020, at 00:09, Dick Hardt <dick.hardt@gmail.com> wrote:
> 
> Hey Vittorio
> 
> (cc'ing OAuth list as this was brought up in the office hours today)
> 
> https://developer.android.com/training/app-links <https://developer.android.com/training/app-links>
> 
> An app is the default handler and the developer has verified ownership of the HTTPS URL. While a user can override the app being the default handler in the system settings -- I don't see how a malicious app can be the default setting.
> 
> What am I missing?
> 
> /Dick
> ᐧ
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth