I read things like this and keep thinking about the "web of trust" from the 90s. There is no way to visit some random app store, or read an email or website, a

I read things like this and keep thinking about the "web of trust" from the 90s. There is no way to visit some random app store, or read an email or website, and trust that it's actually officially what it says it is. The author of this article relies on some heuristics; good spelling, reasonable-sounding developer email, reasonable Java package name, etc. but these things can go either way. It is possible for a scammer to be good at spelling, and it is possible for a big company to contract out some app they don't care about to the lowest bidder and be perfectly running their ads program through the "FooCorp Develop App; ru.definitelynotascam.dumbcodename". It has historically been an okay data point, but in the future scammers are going to be good at English -- it's only a matter of time. Where I'm going with this is that there needs to be some sort of mandatory linkage between something you trust and this random app you see on the app store. You trust Google. You trust TikTok. So why doesn't Google generate some sort of code that TikTok can stick in their DNS (or website) to create a linkage? By default, an app on the store could say "not trusted by any company", but then TikTok could add that record on their website and it would say "Trusted by TikTok" or something. There are some problems with this, of course. Anyone could claim any app, and then you'd see incorrect information. DNS and web servers can be hacked, TLS roots of trust aren't trustworthy, etc. But there has to be some way to create this linkage safely, so that people aren't misled again and again and again in the same way.