Live data from Hacker News

Install web apps with the new HTML install element

developer.chrome.com

11–16 of 16 posts

Re: Install web apps with the new HTML install element

#12

Browsers shouldn't have an install. Can we stop half-baked HTML XML syntax at this point? I forsee abuse of such: const button = document.querySelector('install'); button.addEventListener('promptdismiss', () => { console.log('User dismissed the install prompt but forcing installation of adware, malware and bitcoing mining anyway'); });

This isn't possible, the PWA install flow is managed by the browser.

Re: Install web apps with the new HTML install element

#13
post #9

> the browser's control over the button's label text, language, and appearance means it can trust the user's click as a genuine signal of intent. Like we don't saw fake download bottons imitating the legitime button.

Prompting for installation opens a dialog controlled and populated by the browser that has the name and author of the app to be installed. You can test it on the example page here, linked from the article:

https://microsoftedge.github.io/Demos/pwa-install-element/in...

Re: Install web apps with the new HTML install element

#14
post #13
post #9

> the browser's control over the button's label text, language, and appearance means it can trust the user's click as a genuine signal of intent. Like we don't saw fake download bottons imitating the legitime button.

Prompting for installation opens a dialog controlled and populated by the browser that has the name and author of the app to be installed. You can test it on the example page here, linked from the article: https://microsoftedge.github.io/Demos/pwa-install-element/in...

That not avoid you clicking a fake button imitatatin the good button.

Re: Install web apps with the new HTML install element

#15
post #13

Earlier quoted context omitted.

Prompting for installation opens a dialog controlled and populated by the browser that has the name and author of the app to be installed. You can test it on the example page here, linked from the article: https://microsoftedge.github.io/Demos/pwa-install-element/in...

That not avoid you clicking a fake button imitatatin the good button.

Right, but it does gate the actual installation behind a secondary approval in a trustworthy prompt that the page author doesn't control. The page author could of course make a dangerous-but-trustworthy-looking app that would pass muster for the user's approval, but at that point it's not any different than social engineering the installation of any regular malware, e.g. convincing a user to download and execute a dangerous binary.

Re: Install web apps with the new HTML install element

#16

Since apparently this thread needs context, yes, you can install PWAs from Firefox on Android and I've heard it's returning to desktop. This just seems to be a way (in Chrome) to trigger the already existing PWA install flow but from some styles element on the page, rather than the user knowing how to trigger the install flow (usually multiple clicks). Edit: I wonder if you could do some click-jacking attacks here...

> can install PWAs from Firefox on Android The last time I checked firefox on android didn't support PWAs like Chrome does. It just creates a shortcut to your homescreen. Chrome on android use WebAPKs. You can verify this by looking at the package id in the app info of the created shortcut.

I guess I don't get the distinction? That's some Google-y Chrome-y sounding stuff if I've ever heard of it.

I don't really get it. I click Install in Firefox. I get an app icon. It works, :shrug: ?

Post reply on HN