How do I verify that in-app social login dialogs are secure?
You can't, at least not until mobile OS developers stop prioritizing UX over security.
For now the best you can do is to make sure the app you're using is from a legitimate and trusted developer, and the credentials it's asking for are related to the function of the app (a photo app asking for Instagram credentials to post on it seems alright, but the same photo app asking for Spotify credentials would be more suspicious). Also you should consider that particular account compromised by the app's developer so you should't use that account for information you don't want them to see. On some sites that don't revoke OAuth tokens on password changes, a solution to prevent future unauthorized (outside of the legitimate OAuth flow) access would be to change your password. As the OAuth token would still be valid, the legitimate functionality of the app should still work but sneaky attempts to login using the harvested password would no longer be successful. Of course, this isn't bulletproof as a truly malicious app would probably have a bot running on their servers that changes your account's email and password the second you enter it, preventing you from ever accessing your account.
In the long run, the solution would be to put pressure on mobile OS developers to either stop the nonsense described in my first link or at least provide a secure, OS-controlled WebView alternative that apps can use to request credentials. That WebView should prove to the user it's indeed OS-controlled (by doing something that normal apps can't, like intercepting a home button press) and clearly display the URL that's been requested by the app so it can't attempt to display a phishing site.
This just happened to me. What I did is not trust it and follow these steps:
- Verify the connected devices in my Facebook and that I get notifications for new devices.
- Change my facebook password to something random my password manager gave me.
- Type that password in the in-app view
- Change my facebook password again to another thing. DO NOT log out from all devices when prompted.
- Review everything is in order.
That way, I know for sure I'm the only one who connected in that time and that no one has a valid Facebook password.
However, it's a PITA since the same app could ask me to confirm the identity in the future and doing these steps each time is really inconvenient.