> would have thought the hoops Android/iOS make you jump through to add a PWA would be enough to make people question The og article by ESET Security [0] speci

> would have thought the hoops Android/iOS make you jump through to add a PWA would be enough to make people question The og article by ESET Security [0] specifically talks about (Android/Chrome-supported) WebAPKs essentially bypassing the usual "untrusted sources" warning, and that even the App Info screen shows Play Store as the origin source for all installed WebAPKs. > tricky to teach someone to be tech literate with a moving target Not fool proof, but given the IoCs, think it might be best to block all but top 50k domains by default. Or, inform users if a domain they've never previously visited asks them to enter anything via clipboard or keyboard. [0] https://www.welivesecurity.com/en/eset-research/be-careful-what-you-pwish-for-phishing-in-pwa-applications/ https://www.welivesecurity.com/en/eset-research/be-careful-w... / https://archive.md/29SKK https://archive.md/29SKK (hat-tip u/ChrisArchitect)