Users are able to register apps that look official (for phishing)

Question

Recently, a user was able to register an app with the name "StackOverflow".
Alarmed, I tried it myself.

If you click this authorization link, you will see:

... which sure looks official.

This is ripe for mischief, phishing, and worse.

---

The registration page has a placeholder attribute that says:

Be Unique! Avoid implying an official Stack Exchange relationship

^{(Emphasis added.)}

But, that didn't stop that user (nor myself) from creating a misleading app name.

The authorization page should identify it as a third party app regardless.

---

Note that there is an additional bug whereby the page seems to be for Stack Overflow, but the app is really being authorized for all Stack Exchange sites^‡.

---

Recommendations:

1. The authorization page should make clear that they are authorizing a third party app.
2. Official Stack Overflow/Exchange/etc. logos should not appear to belong to the third party app.
3. App names, like "Stack Overflow", etc. should be automatically blocked from registration. But official names part of a longer string should be okay. EG: "Stack Overflow comment filter".
4. The App's description should also be shown on the authorization page (and not allowed to be blank).

---

‡ Except for Area51. Teams also has a bit different behavior -- at least for me.

Answer 1

I quite like GitHub's OAuth login screen, which I think we could take ideas from (if you want to see it yourself, try using Login-with for an example):

Here it clearly states that it's not operated by GitHub which is the most important thing.

It also tells the user what to expect after clicking the authorise button (the redirect), which I think is pretty useful because I know a lot of users have no idea what to expect -- since developers can set whatever redirect URL they want, they could be redirected to a domain the end-user has never seen before!

Whilst we're at it, it would also be nice to mention that the user can, at any time, revoke access and a link to a help page or the apps page would be useful. Because right now, that screen is hidden away in the user profile on the /users/apps/id page (/current at the end doesn't work :()