On which Android versions was it usual for apps to ask, inside own window, for password of app of other legal entity?
2
votes
0
answers
63
views
When i tried to open my Whatsapp chats from web browser on laptop, and wanted to scan a QR code from Whatsapp on my smartphone, Whatsapp asked for password, indide the same Whatsapp window. As i have found from https://faq.whatsapp.com/web/download-and-installation/how-to-log-in-or-out?lang=en , it asks for Android's screen lock password.
> To log in to WhatsApp on WhatsApp Web, WhatsApp Desktop, or Portal,
> you need to use your phone to scan the QR code.
>
> Android: Tap LINK A DEVICE. Follow the on-screen instructions if your
> device has biometric authentication. If you don’t have biometric
> authentication enabled, you’ll be prompted to enter the pin you use to
> unlock your phone.
>
> Note: The authentication is handled by your device’s operating system
> using the biometrics stored there. WhatsApp can’t access the biometric
> information stored by your device's operating system.
Also I had seen similar behaviour with other apps, when app of a state service asked, in own window, for password of other state service.
I have found out that Facebook also used to allow for apps to ask for Facebook password in their windows:
https://developers.facebook.com/blog/post/2021/06/28/deprecating-support-fb-login-authentication-android-embedded-browsers/?locale=en_US
> We have been monitoring an uptick in phishing attempts on Android
> embedded browsers (also known as webviews), so beginning in August, we
> will no longer support FB Login authentication on Android embedded
> browsers.
>
> If your app is using version 8.2+ of the SDK, we utilize several
> methods to authenticate the user through other methods -- including
> options like sending a push notification to verify the user’s identity
> (a.k.a. “Passwordless flow”) or asking the user to complete the login
> in the Chrome browser (Chrome Custom Tabs) or Facebook Android app
> (a.k.a. Android App Switch).
I have searched for Android docs and have found this:
https://developer.android.com/training/sign-in/biometric-auth
I see there screenshots where dialog windows are shown, while all background is darkened, including Android's top panel... But seems this is a new version of Android, and I used Android 6.
Whith which Android version these separate dialog windows for authentication first appeared?
I checked for older version of this page, https://web.archive.org/web/20191002021720/https://developer.android.com/training/sign-in/biometric-auth , and i see there were same dialogs in 2019, no older archives.
What is Android's policy/recommendation on asking for password of other legal entities? I have seen https://developer.android.com/topic/security/best-practices and I did not see there any such recommendation. I think it is not secure, because, probably it is possible for a window to log any passwords entered in it.
Asked by qdinar
(131 rep)
Jan 12, 2022, 02:43 PM