[chrismoos]

An in-app browser isn't the only way to provide OAuth, on most platforms you can invoke a URL and the browser application will open on the phone.

For example, on iPhone you can invoke an HTTP(s) URL, your app will exit, mobile safari opens, and you can then login and know that what you are typing is as secure as the OS/app sandboxing is....take a look at how the Facebook iPhone SDK flow works, its actually quite nice and very easy for users.

In reality, if you want to know that you aren't giving your username/password to a malicious third party, as an end user, you have to deal with a little inconvenience...being redirected in your browser to an SSL page that you trust, for example.

[nupark2]

If the "third party" is actually a malicious native application, they can just simulate the launch of Safari, and most users probably won't even notice.

In this threat model, OAuth is practically a security no-op and a huge usability negative.

[chrismoos]

Yeah they could simulate the launch, good point. I guess you'd have to hit the home button to know you are leaving the app. Sucks :(