[Jensson]

> You can simply relay the requests to the original site/"webapp", no need to build one similar

Doesn't work if the app encrypts messages locally, so end to end encryption is still valid with this.

[g-b-r]

We're talking about normal browsing, not webapps performing their encryption

[isilofi]

Webapps are also vulnerable because the Javascript can be manipulated in a MitM attack.

The only way around this would be a "real" app.

[g-b-r]

True