I've been thinking about Oauth login which works wonderfully for websites in general.

However these login types are becoming more prevalent in apps, both desktop and mobile. In these situations often the challenge page from the third party is displayed in an in app window, not a browser.

In these cases the hosting application could definitely fake the third parties challenge page to steal the users credentials.

Are there any best practices or systems in place to prevent this?