3 ms·
ClickJacking target? I would have expected the App Clip UI to have better integration with OS or Safari browser chrome, so that it wouldn't be possible to spoo
by ozten 6y ago
ClickJacking target?
I would have expected the App Clip UI to have better integration with OS or Safari browser chrome, so that it wouldn't be possible to spoof from a web page.
Since it floats entirely within content, it seems like you could make a click jacking attack from a Safari experience.
Just one screenshot, maybe this is mitigated somehow...
- jedieaston 6y agoThe app clips still have to go through app review and the user is asked for consent before it is downloaded and launched. You also have to create them as part of a full app in the App Store (although for the restaurant ordering scenario, GrubHub or whoever would make an app clip for the small restaurant that didn't have a presence on the App Store).
- ozten 6y agoRight. This would be simulating an app clip via HTML5 to trick a user into thinking they are using a safe app clip, but actually it is just a web page.