As the author notes, the App Store provides a measure of defense against this. Apps that do this might get away with it at first but will eventually be discover

As the author notes, the App Store provides a measure of defense against this. Apps that do this might get away with it at first but will eventually be discovered and banned. Plus 2FA also protects you from this. iOS has easy-to-use 2FA and is on a good trajectory of mainstreaming it and driving adoption. I'm not sure his proposal for defeating 2FA would work: > even with 2FA enabled accounts, what if the app asked you for your 2 step code? Most users would gladly request a 2FA-token and ask for it, and directly pipe it over to a remote server. I wouldn't give this much credence without a proof of concept. iOS throws up a dialog when there's a pending 2FA request which consumes the code or cancels the request, so that would prevent the app UI from intercepting it.