Sign in with Google: how OAuth lets an app in without your password
Authorization code: what travels back through your browser after you tap Allow
You tap Allow, and Google must send the app something back through your browser, which writes every address into its history. What can travel that road safely after Sign in with Google?
-
1
You tapped Allow. Google answers by sending your browser back to the app, and it can tuck something into the address of that page.
-
2
But whatever rides in an address can be seen again later: in the history of your browser, on a shared computer, in the lists of visits that websites keep. A way into your calendar would not be safe there.
The rest of this episode is for subscribers
Subscribe to read every premium episode. You can cancel when you want.
Paid yearly: $99 instead of $119.88