Sure, I get that.

Sure, I get that. I'm still just having a hard time imagining trying to exploit this, because it's impossible to hide that you did it from the user, and it completely breaks the app you're trying to take advantage of (since you took over its URL handler, it can never receive the expected information, so you can't even try to immediately pass the data to the real app and hope the user doesn't notice). Assuming the model where you send a request to another app, which then sends the secret data (such as an OAuth token) back to you, it also seems rather trivial to defeat (if you're the app with the secret data). Just require the sending app synthesize a random binary string and send it to you, and use that as a one-time pad for the data. You know your URL handler is secure (because otherwise it can't have been invoked), and this way you know that even if some other app intercepts the reply, they can't understand it. Granted, this doesn't work for the model where you send secret data in your initial request to the other application, but I can't even think of any examples of apps that do that.

Posted by eridius on Jun 17, 2015, 9:32 PM

Tags

• hackernews (SaaS)

Related issues

• That's the biggest problem with iOS because Apple can be ordered to block them from the App Store and it would be instantly kill these pr...
• I'm intrigued about the "Trip Planner" being a top-level app.
• This asymmetry is IMO the biggest problem with AI-driven output.
• This is one of the most important objectives in software today.
• At least in Europe - these rouge corporations need to be reined in or just leave the market.
• I was skeptical, but this looks genuinely useful.