5 ms·

Yes, but phones do have curated mobile app stores. Not the case with desktop computers, so it's dangerous.

• danShumway 5y ago
  Hrm. Mac computers allow this with Slack. The installed version can intercept links to messages in the browser and open them in the app instead of the website. So I don't think it's just phones doing this today. And I guess Slack is signed on Mac via Gatekeeper, but it's not distributed through an app store. I don't run Windows and I won't install Slack natively on my Linux boxes, so I can't check the other platforms. But I would be a little surprised if the same doesn't work on them. This is basically how mailto links work today, right? See https://developer.mozilla.org/en-US/docs/Web/API/Navigator/registerProtocolHandler/Web-based_protocol_handlers https://developer.mozilla.org/en-US/docs/Web/API/Navigator/r...
  • ivanmontillam 5y ago
    In this case mailto:// doesn't try to impersonate any app, but if it were to be done (for example) "skype://" I could install another app that overrides the current app protocol, and mislead the user and catch privileged data intended for the original app. But of course, technically it's the exact same thing, it's just a layer above. So you have a point.
  • notriddle 5y ago
    > Hrm. Mac computers allow this with Slack. On Linux, Slack installs a custom protocol handler, and includes a hidden iframe with the slack://RANDOMSTRING/magic-login/LONGRANDOMSTRING URL. I assume it's the same on Mac.