Hacker News Reader

Comment by Pfhortune | Hacker News Reader

PWA as a mechanism for delivering phishing apps is an interesting avenue. I would have thought the hoops Android/iOS make you jump through to add a PWA would be enough to make people question whether they are doing the right thing. The fact that folks did not find it odd that they had to do a particular dance to install the "app" from the "app store" is just... tragic.

I do not know what education is like where this campaign seems to have taken place (Czech Republic), but really basic tech literacy should be taught in schools. I know it's tricky to teach someone to be tech literate with a moving target like evolving tech, but we should be _trying_.

View on HN

> would have thought the hoops Android/iOS make you jump through to add a PWA would be enough to make people question

The og article by ESET Security [0] specifically talks about (Android/Chrome-supported) WebAPKs essentially bypassing the usual "untrusted sources" warning, and that even the App Info screen shows Play Store as the origin source for all installed WebAPKs.

> tricky to teach someone to be tech literate with a moving target

Not fool proof, but given the IoCs, think it might be best to block all but top 50k domains by default.

Or, inform users if a domain they've never previously visited asks them to enter anything via clipboard or keyboard.

[0] https://www.welivesecurity.com/en/eset-research/be-careful-w... / https://archive.md/29SKK (hat-tip u/ChrisArchitect)

Tech literacy even in this day and age isn't equally distributed everywhere.

Also, i wonder if this is a generational thing...Because a couple decades ago, there was a generation (or at least a percentage of the generation) that learned through pain that installing unknown apps on a desktop became a risky potentially harmful thing to do. Then the Web came along and that generation being more savvy on the desktop side had to learn that websites (even without "installing something on the desktop) also come with risks and problems...and now we have a likely younger generation who never lived through the dangers of installing stuff on a device....they've known web stuff and app stores...and have grown to somewhat trust app stores...so they lack the understanding of risks associated with "installing stuff". I have only personal data to substantiate my theory...so i'm just talking out of my pocket. :-)

> basic tech literacy should be taught in schools

You're blaming the victim.

Technology is too complex and continues changing too fast. I'm a software engineer and I couldn't tell you what half the processes on my machine are supposed to be doing, and even if I did that wouldn't help spot even a trivial piece of malware.

Last time I attended school, smartphones didn't even exist yet. That's fair; sometimes there's a fundamental shift in how we do things. But meanwhile Google alone launched and killed how many chat/video call apps? Unfortunately you have to keep installing these every now and then, because that's somehow still an unsolved problem.

Security is simplicity, if a system is complex then it's easy to confuse the user into doing the insecure thing.

Fair. Though I still think we need a tech equivalent of "look both ways before crossing the street." Though as I type this and think it through... Cars aren't trying to deliberately camouflage themselves as harmless parts of the environment, which is the logical equivalent to this particular case.

And cities designed for humans (as opposed to cars) take a lot of care to slow down (or entirely divert) the traffic in places where there are a lot of humans, make crossings safer, provide decent public transport, keep cyclists safe, etc.

In my current city (Vienna), I still tend to look both ways out of habit, but in many places (like my neighbourhood) I actually feel safe crossing without actively looking.

I'm not sure tech literacy can be taught, but mostly because of the constant treadmill of changing UIs. Things that used to be safe are not anymore, because people (Chrome in this case) keeps trying to make things "easier", damn the consequences.

This so-called basic tech literacy is obsolete in some years. We just don’t get it how can people be so disinterested in how things work.

Reply on news.ycombinator.com