Phishing attack prevention for OAuth applications
An example operation may include one or more of obtaining a request to validate an application with respect to an OAuth provider, identifying a previously registered digital signature of the application, generating verification information of the application based on the identified digital signature of the application, and passing the generated verification information of the application to the OAuth provider via a user login page.
1. A computing system comprising:
a network interface; and
a processor configured to obtain a request to validate an application with respect to an OAuth provider, identify a previously registered digital signature of the application, and generate verification information of the application based on the identified digital signature of the application,
wherein the processor is further configured to: control the network interface to pass the generated verification information of the application to the OAuth provider via a user login page and generate a unique application-based one-time password based on a shared secret with the OAuth provider and the application signature.
2. The computing system of claim 1 , wherein the processor is configured to trigger the request in response to a detection of a cursor position on a password field of the login page of the OAuth provider.
3. The computing system of claim 1 , wherein the processor is further configured to transmit the generated verification information to the OAuth provider via a user credential field of the login page of the OAuth provider.
4. The computing system of claim 1 , wherein the processor is configured to generate the one-time password based on the application signature.
5. The computing system of claim 1 , wherein the processor is configured to generate the unique application-based one-time password based on a timestamp.
6. The computing system of claim 1 , wherein the generated verification information is transmitted to the OAuth provider in association with a request to grant the application access to user data stored at the OAuth provider.
7. The computing system of claim 1 , wherein the processor is further configured to validate the application based on signature data stored in a table that includes valid signatures of a plurality of applications previously registered with the OAuth provider.
8. The computing system of claim 1 , wherein the generated verification information of the application is transmitted for a user login associated with the request instead of transmission of user login credentials.
9. A method comprising:
obtaining a request to validate an application with respect to an OAuth provider;
identifying a previously registered digital signature of the application;
generating verification information of the application based on the identified digital signature of the application; and
passing the generated verification information of the application to the OAuth provider via a user login page;
wherein a unique application-based one-time password is generated based on a shared secret with the OAuth provider and the application signature.
10. The method of claim 9 , wherein the method further comprises triggering the request in response to a detection of a cursor position on a password field of the login page of the OAuth provider.
11. The method of claim 9 , further comprising transmitting the generated verification information to the OAuth provider via a user credential field of the login page of the OAuth provider.
12. The method of claim 9 , wherein the generating the verification information comprises generating the one-time password.
13. The method of claim 9 , wherein the generating the verification information comprises generating the unique application-based one-time password based on a timestamp.
14. The method of claim 9 , wherein the generated verification information is transmitted to the OAuth provider in association with a request to grant the application access to user data stored at the OAuth provider.
15. The method of claim 9 , wherein the identifying further comprises validating the application based on signature data stored in a table comprising valid signatures of a plurality of applications previously registered with the OAuth provider.
16. The method of claim 9 , wherein the generated verification information of the application is transmitted for a user login associated with the request instead of transmitting user login credentials.
17. A non-transitory computer readable medium comprising instructions, that when read by a processor, cause the processor to perform a method comprising:
obtaining a request to validate an application with respect to an OAuth provider;
identifying a previously registered digital signature of the application;
generating verification information of the application based on the identified digital signature of the application; and
passing the generated verification information of the application to the OAuth provider via a user login page;
wherein a unique application-based one-time password is generated based on a shared secret with the OAuth provider and the application signature.
18. The non-transitory computer readable medium of claim 17 , wherein the generated verification information of the application is transmitted for a user login associated with the request instead of transmitting user login credentials.
19. The non-transitory computer readable medium of claim 17 , wherein the method further comprises triggering the request in response to a detection of a cursor position on a password field of the login page of the OAuth provider.
20. The non-transitory compute readable medium of claim 17 , wherein the generating the unique application-based one-time password based on a timestamp.