Developer warns that in-app browsers can keylog on iOS, recommends Safari for OAuth handshake
In-App Browsers Considered Harmful — How many apps on your iPhone or iPad have a built-in browser? — Would it surprise you to know that every one of those apps could eavesdrop on your typing?
Context & Ripple Effects
Furbo.org's warning lands on top of a short but pointed history: researchers had already shown in February 2014 that iOS devices could be made susceptible to covert keylogging, and a 'Covert Redirect' flaw in OAuth 2.0 and OpenID was disclosed in May 2014 as exploitable to steal personal information. The new piece connects those threads at the app layer — any app shipping its own built-in browser sits in a position to eavesdrop on typing during the very login flows users trust least to third parties.
It also rhymes with old advice: back in July 2007, SPI Labs urged avoiding an iPhone feature on security grounds, so the pattern of third parties flagging Apple's convenience-first defaults is well-worn. The breadth of same-day pickup — MacRumors, Gizmodo, 9to5Mac, Six Colors and others all carried it — signals how directly the finding hits every app with an embedded browser, which is most of them.
First-order effects
- Developers whose apps handle OAuth logins inside an in-app browser are told to switch those handshakes to Safari immediately, or accept that their own code can capture every keystroke a user types there.
- App makers with embedded browsers now face a trust problem they did not price in: the capability to keylog exists regardless of intent, so each has to prove — not just assert — it does not abuse it.
Second-order effects
- Social-login providers and SDK vendors whose buttons get embedded in native webviews come under pressure to steer integrators toward system-browser flows, since their sign-in pipes inherit the eavesdropping risk.
- Apple is pushed toward making Safari the sanctioned authentication surface on iOS, sharpening a line between what the OS trusts and what any third-party app may render itself.
Third-order effects
- If the pattern holds, authentication migrates structurally out of embedded browsers and into the system browser as a trust boundary — an architectural split between apps that merely display web content and the one browser the platform vouches for.
- The episode feeds a longer-running governance question about who audits the invisible capabilities bundled into SDKs and embedded components, where the party best positioned to eavesdrop is the party nobody vetted.
The trend: Mobile platforms are being pushed to treat the system browser, not the embedded webview, as the trusted boundary for authentication — with each keylogging or redirect disclosure accelerating that migration.