Live data from Hacker News

Progressive Web Apps (PWAs) Phishing

mrd0x.com

41–44 of 44 posts

Re: Progressive Web Apps (PWAs) Phishing

#41
post #17
post #15

Earlier quoted context omitted.

Nope, it's much more insidious than that. The user is already on your website, which could be a legitimate website with a malicious owner. If you look at the screenshot, it's a perfectly valid interpretation for a non tech-savvy user to interpret that as "realhealthysnacks is asking me to install a legitimate Microsoft application". Now change the simplified example for a real one from a SaaS product login page with…

> legitimate website with a malicious owner. What... does that mean? A website with a malicious owner is illegitimate by definition. :) But more to the point, this logic is circular. You're saying PWAs are subject to attack by malicious actors because their users can be attacked by websites controlled by malicious owners. Which is... true. But specious, and true of regular web pages and apps and every other kind of s…

> That is obviously a very hard problem with only imperfect solutions.

One of those imperfect solutions is training users to always check the URL bar. PWAs let the attacker inject a fake URL bar AND hide the real URL bar.

Re: Progressive Web Apps (PWAs) Phishing

#44

Earlier quoted context omitted.

Many applications will obtain such a token through an OAuth flow of some kind. Using a browser-integrated password manager or passkey will usually prevent this attack, though.

Nah, it won't because it happens all the time that my password manager doesn't recognize the current url because the auth signin flow had so many weird urls in it that I had to save the url manually and now it's not the right url so I copy out the password manually instead of autofilling it. This was actually the case for my Google account which I created through gmail but then my gmail password wasn't using the righ…

Your right about simple password managers, but passkeys do prevent this flaw.
Post reply on HN