Exactly, and I disagree on education. People can and must be taught on security (not just phishing). But that also mean some standardization on the browser UI a

Exactly, and I disagree on education. People can and must be taught on security (not just phishing). But that also mean some standardization on the browser UI and not trying to make it "seamless" and "transparent". This exploit is the result of voluntarily blurring the lines between Traditional Apps and Web Apps. Well, the threat model being very different, it's not a good idea. HTTPS is a part of a whole and pushing so hard make people (even tech savvy ones) focus too much on it. How many CTOs are happy with just putting HTTPS on their website so they can check the security checkbox ?