38

Recently, a user was able to register an app with the name "StackOverflow".
Alarmed, I tried it myself.

If you click this authorization link, you will see:

real bad

... which sure looks official.

This is ripe for mischief, phishing, and worse.


The registration page has a placeholder attribute that says:

Be Unique! Avoid implying an official Stack Exchange relationship

(Emphasis added.)

But, that didn't stop that user (nor myself) from creating a misleading app name.

The authorization page should identify it as a third party app regardless.


Note that there is an additional bug whereby the page seems to be for Stack Overflow, but the app is really being authorized for all Stack Exchange sites.


Recommendations:

  1. The authorization page should make clear that they are authorizing a third party app.
  2. Official Stack Overflow/Exchange/etc. logos should not appear to belong to the third party app.
  3. App names, like "Stack Overflow", etc. should be automatically blocked from registration. But official names part of a longer string should be okay. EG: "Stack Overflow comment filter".
  4. The App's description should also be shown on the authorization page (and not allowed to be blank).






‡ Except for Area51. Teams also has a bit different behavior -- at least for me.

  • What happens if you use the name “Stack Overflow” (with space) as per the brand guidelines a space is required? – MEE was the missing bracket Mar 24 at 7:02
  • 2
    Well, the user who did it should be suspended for a while, that's for sure. – Shadow The Coffee Wizard Mar 24 at 10:31
  • Yes, not following the brand guidelines is a hanging offense. – Rob Mar 24 at 20:38
16

I quite like GitHub's OAuth login screen, which I think we could take ideas from (if you want to see it yourself, try using Login-with for an example):

GitHub OAuth login screen

Here it clearly states that it's not operated by GitHub which is the most important thing.

It also tells the user what to expect after clicking the authorise button (the redirect), which I think is pretty useful because I know a lot of users have no idea what to expect -- since developers can set whatever redirect URL they want, they could be redirected to a domain the end-user has never seen before!

Whilst we're at it, it would also be nice to mention that the user can, at any time, revoke access and a link to a help page or the apps page would be useful. Because right now, that screen is hidden away in the user profile on the /users/apps/id page (/current at the end doesn't work :()

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .