Sign in with Google: how OAuth lets an app in without your password
PKCE: how a phone app signs you in with Google when it cannot keep a secret
Anyone who downloads a phone app can look inside it, so a phone app cannot keep a secret. How does it still sign you in with Google safely?
-
1
So Rono starts on the phone app. But anything inside a phone app can be read by anyone who downloads it and takes it apart, and a client secret put in there would be a secret for nobody.
-
2
And on its way back from Google, the code passes through your phone, where another app that answers to the same return address could catch it. With no secret to check at the trade, a caught code would be as good as the real thing.
The rest of this episode is for subscribers
Subscribe to read every premium episode. You can cancel when you want.
Paid yearly: $99 instead of $119.88