Google to Block Logins From Embedded Browsers to Prevent Phishing
Google on Thursday announced that it will soon block login attempts from embedded browser frameworks in an effort to prevent man-in-the-middle (MitM) phishing attacks.
The tech giant says phishing attacks that involve traffic interception are difficult to detect when an embedded browser framework or a different type of automation platform is used for authentication.
As an example of an embedded browser framework Google provided its Chromium Embedded Framework (CEF), which is designed for embedding Chromium-based browsers in other applications.
Since its systems can’t make the difference between legitimate logins and MitM attacks when such frameworks are used, Google has decided that, starting with June, it will block sign-ins from these frameworks.
The company says this latest move is similar to webview sign-in restrictions announced in April 2016.
“The solution for developers currently using CEF for authentication is the same: browser-based OAuth authentication. Aside from being secure, it also enables users to see the full URL of the page where they are entering their credentials, reinforcing good anti-phishing practices,” said Jonathan Skelker, Product Manager of Account Security at Google.