Recently, a user was able to register an app with the name "StackOverflow".
Alarmed, I tried it myself.
If you click this authorization link, you will see:
... which sure looks official.
This is ripe for mischief, phishing, and worse.
The registration page has a placeholder
attribute that says:
Be Unique! Avoid implying an official Stack Exchange relationship
(Emphasis added.)
But, that didn't stop that user (nor myself) from creating a misleading app name.
The authorization page should identify it as a third party app regardless.
Note that there is an additional bug whereby the page seems to be for Stack Overflow, but the app is really being authorized for all Stack Exchange sites‡.
Recommendations:
- The authorization page should make clear that they are authorizing a third party app.
- Official Stack Overflow/Exchange/etc. logos should not appear to belong to the third party app.
- App names, like "Stack Overflow", etc. should be automatically blocked from registration. But official names part of a longer string should be okay. EG: "Stack Overflow comment filter".
- The App's description should also be shown on the authorization page (and not allowed to be blank).
‡ Except for Area51. Teams also has a bit different behavior -- at least for me.