[...] This opens the door for other apps to run malicious code, such as registering callbacks that try to intercept usernames and passwords. Additionally, a malicious app could open another web page that mimics the Link flow in a phishing attempt.
I'm not sure what type of threat model they have, but I don't see how this increases security at all. If the app is malicious, there's nothing preventing them from faking the CCT interface, or omitting it all together. It's not like users would be suspicious if they were asked for credentials outside of a chrome custom tab.
Ironically, Plaid is doing the same thing. Their login screen[1] is designed to look like you're logging into your bank, even though your passwords are sent in plain text to plaid.
Comments
I'm not sure what type of threat model they have, but I don't see how this increases security at all. If the app is malicious, there's nothing preventing them from faking the CCT interface, or omitting it all together. It's not like users would be suspicious if they were asked for credentials outside of a chrome custom tab.
Ironically, Plaid is doing the same thing. Their login screen[1] is designed to look like you're logging into your bank, even though your passwords are sent in plain text to plaid.
[1] https://plaid.com/demo/?countryCode=US&language=en&product=t...