Hacker News new | ask | show | jobs
by CobsterLock 1834 days ago
I think mankyd knew that. I'm thinking the exploit would be installing a bad app that enforces redirects for mybank.com, youbank.com, usabank.com, ukbank.com, allbanks.com to their malicious app. Then the app just knows how to pretend to be the login screen for all these apps and bam you get a whole ton of passwords. The key thing would be for the app not to show the url of their malicious site.
1 comments
danShumway 1834 days ago
Phones already do this though, don't they? I think Android at least allows redirecting links to apps, and I'm pretty sure Mac does as well.

Is there a bigger threat model people are worried about with extending the app schema to include normal URLs as well? Or do you just think the problem would be worse if the scope was broader?

Trying to figure out where people are drawing the line on this.

link
machello13 1834 days ago
On iOS and macOS (I can't speak to Android but I'm fairly sure it's a similar mechanism), you're required to prove that a domain and app are linked before allowing URLs to open in your app. You do this by hosting a JSON file on your website that points to your app and specifies which kind of URLs should be redirected. E.g. see https://apple.com/.well-known/apple-app-site-association for how Apple.com does it.

This prevents malicious third-parties from opening bank.com in their own app, but of course it also prevents useful things like using a custom YouTube app.

link
ivanmontillam 1834 days ago
Yes, but phones do have curated mobile app stores. Not the case with desktop computers, so it's dangerous.
link
danShumway 1834 days ago
Hrm. Mac computers allow this with Slack. The installed version can intercept links to messages in the browser and open them in the app instead of the website. So I don't think it's just phones doing this today.

And I guess Slack is signed on Mac via Gatekeeper, but it's not distributed through an app store.

I don't run Windows and I won't install Slack natively on my Linux boxes, so I can't check the other platforms. But I would be a little surprised if the same doesn't work on them. This is basically how mailto links work today, right?

See https://developer.mozilla.org/en-US/docs/Web/API/Navigator/r...

link
notriddle 1833 days ago
> Hrm. Mac computers allow this with Slack.

On Linux, Slack installs a custom protocol handler, and includes a hidden iframe with the slack://RANDOMSTRING/magic-login/LONGRANDOMSTRING URL. I assume it's the same on Mac.

link
ivanmontillam 1833 days ago
In this case mailto:// doesn't try to impersonate any app, but if it were to be done (for example) "skype://" I could install another app that overrides the current app protocol, and mislead the user and catch privileged data intended for the original app.

But of course, technically it's the exact same thing, it's just a layer above. So you have a point.

link