Progressive Web Apps (PWAs) Phishing
mrd0x.com
Progressive Web Apps (PWAs) Phishing
1–10 of 44 posts
Re: Progressive Web Apps (PWAs) Phishing
#2I think you could do the same in native apps? So yeah, not much you can do about uncareful users. I suppose you could use something like an App store to provide some checks and a little more security. But then you're likely to run into monopolies again..
Re: Progressive Web Apps (PWAs) Phishing
#3I think you could do the same in native apps? So yeah, not much you can do about uncareful users. I suppose you could use something like an App store to provide some checks and a little more security. But then you're likely to run into monopolies again..
I guess the argument would be that a screened app store would block such a malicious app.
But since the trick requires the user to go to a malicious website to install this app, it seems to me that the user might similarly be tricked into entering credentials on that website.
Re: Progressive Web Apps (PWAs) Phishing
#4What's the difference between this and just having a button on your website that redirects to a spoof microsoft login page?
Re: Progressive Web Apps (PWAs) Phishing
#5What's the difference between this and just having a button on your website that redirects to a spoof microsoft login page?
Because this one makes it look like there’s a url bar with a Microsoft domain
Re: Progressive Web Apps (PWAs) Phishing
#6I think you could do the same in native apps? So yeah, not much you can do about uncareful users. I suppose you could use something like an App store to provide some checks and a little more security. But then you're likely to run into monopolies again..
I guess the argument would be that a screened app store would block such a malicious app. But since the trick requires the user to go to a malicious website to install this app, it seems to me that the user might similarly be tricked into entering credentials on that website.
Ideally, the best defense here is a FIDO-compliant 2FA or Passkey that would properly not send a valid credential for a different domain.
Re: Progressive Web Apps (PWAs) Phishing
#7Does this fool tools like 1Password?
Re: Progressive Web Apps (PWAs) Phishing
#8Does this fool tools like 1Password?
No as the page's URL is still not the real login URL. The shown address bar is just a fake with styled website content if I understood it correctly. Really smart!
Re: Progressive Web Apps (PWAs) Phishing
#9I think you could do the same in native apps? So yeah, not much you can do about uncareful users. I suppose you could use something like an App store to provide some checks and a little more security. But then you're likely to run into monopolies again..
I guess the argument would be that a screened app store would block such a malicious app. But since the trick requires the user to go to a malicious website to install this app, it seems to me that the user might similarly be tricked into entering credentials on that website.
This looks a lot like a Oauth request, where you are redirected to sign-in. You check the URL and enter the creds, with the assumption that you are using "Sign in with Microsoft" to login to the site since this is how that login flow works
Re: Progressive Web Apps (PWAs) Phishing
#10What's the difference between this and just having a button on your website that redirects to a spoof microsoft login page?
A PWA can have the familiar "Sign in with google" button now, which pops up a similar page as shown in the article, but with accounts.google.com in the fake URL bar.