title:
On which Android versions was it usual for apps to ask, inside own window, for password of app of other legal entity?
content:
When i tried to open my Whatsapp chats from web browser on laptop, and wanted to scan a QR code from Whatsapp on my smartphone, Whatsapp asked for password, indide the same Whatsapp window. As i have found from https://faq.whatsapp.com/web/download-and-installation/how-to-log-in-or-out?lang=en , it asks for Android's screen lock password.
To log in to WhatsApp on WhatsApp Web, WhatsApp Desktop, or Portal, you need to use your phone to scan the QR code.
Android: Tap LINK A DEVICE. Follow the on-screen instructions if your device has biometric authentication. If you don’t have biometric authentication enabled, you’ll be prompted to enter the pin you use to unlock your phone.
Note: The authentication is handled by your device’s operating system using the biometrics stored there. WhatsApp can’t access the biometric information stored by your device's operating system.
Also I had seen similar behaviour with other apps, when app of a state service asked, in own window, for password of other state service.
I have found out that Facebook also used to allow for apps to ask for Facebook password in their windows:
We have been monitoring an uptick in phishing attempts on Android embedded browsers (also known as webviews), so beginning in August, we will no longer support FB Login authentication on Android embedded browsers.
If your app is using version 8.2+ of the SDK, we utilize several methods to authenticate the user through other methods -- including options like sending a push notification to verify the user’s identity (a.k.a. “Passwordless flow”) or asking the user to complete the login in the Chrome browser (Chrome Custom Tabs) or Facebook Android app (a.k.a. Android App Switch).
I have searched for Android docs and have found this:
https://developer.android.com/training/sign-in/biometric-auth
I see there screenshots where dialog windows are shown, while all background is darkened, including Android's top panel... But seems this is a new version of Android, and I used Android 6.
Whith which Android version these separate dialog windows for authentication first appeared?
I checked for older version of this page, https://web.archive.org/web/20191002021720/https://developer.android.com/training/sign-in/biometric-auth , and i see there were same dialogs in 2019, no older archives.
What is Android's policy/recommendation on asking for password of other legal entities? I have seen https://developer.android.com/topic/security/best-practices and I did not see there any such recommendation. I think it is not secure, because, probably it is possible for a window to log any passwords entered in it.
tags:
security password authentication
