2FA Not Working for Me on Android

I’m not an expert, but I can explain some of the general reasons I’m aware of with how it’s working and why

Many apps, including the Wyze app, use OAuth 2.0 for authentication, which often involves redirecting the user to a web browser to log in. This is because OAuth 2.0 requires a secure way to handle user credentials, and using the system browser ensures that the credentials are not exposed to the app itself.

But wait! We’re staying within the Wyze app now (we actually sometimes used to be redirected log in to the separate browser app outside the Wyze app)! So isn’t everything exposed to Wyze app against the oauth requirements? Well, yes and no… While it is absolutely more secure to use the separate system browser app for oauth login, it’s actually common and allowed for apps to use what is called “WebView” (an embedded browser within the app), or what is called “chrome custom tabs” (recommended for the benefits of shared state, security, and customization to make everything match the app’s look and feel). This is what Wyze is doing now.

There are many reasons to use the embedded webview version of the browser or the chrome custom tabs instead of the system browser. One of the main reasons is that it is less confusing to users and matches their expectations better. It provides a “Seamless Flow.” Using an in-app browser keeps the user within the app, providing a more seamless and integrated experience.

Chrome custom tabs are basically still the Chrome Browser but are Ideal for displaying external web content, such as authentication pages or external links, without leaving the app. That is what [I believe/understand] is happening here and why sometimes there are conflicts with other browsers, particularly back when they had some authentication happening through the system browser instead of the webview or chrome custom tabs they are apparently using now.

:+1:

(Not that exposing Wyze credentials to the wyze app is a risk… But it’s just a general requirement or practice for oauth as I understand it, so it is supposed to be this way. Though I could be wrong and misunderstand. Just explaining how I understand it)

1 Like