They could protect against that easily by simply adding a header to all outgoing requests saying "this request originated from com.appname". If a website didn'

They could protect against that easily by simply adding a header to all outgoing requests saying "this request originated from com.appname". If a website didn't want to be embedded in that app, the webpage could refuse to let the user log in. The whole thing is a bit moot, because any app can just implement their own web renderer or just fake the login screen to Chase.com entirely to get the users creds.