Comment

The problem is here is this: how is a user supposted to know if the official website of an application is organicmaps.app, organic-maps.app, organicmaps.org or github.com/organicmaps?

And even if she/he knows, hackers do ways to make you look the other way. The funny thing in this case is that the original author complained that the app was removed from google playstore, and did so on the fosstodon mastodon-server. Although I guess this was not at planned, he made the almost perfect social-engineering post. :-)

source

Sort:hotnew top

moonpiedumplings@programming.dev ⁨3⁩ ⁨months⁩ ago
en.wikipedia.org/wiki/Organic_Maps

Repositoryorganicmaps on GitHub

Unironically, wikipedia is pretty good for getting official links to projects/websites. It’s not a guarantee, but it’s a lot betted than just googling it,

source
gencha@lemm.ee ⁨3⁩ ⁨months⁩ ago
I totally agree with you on the phishing aspect. Good thinking.

I would prefer it if people already knew the domain from prior association. I still download desktop software regularly on the developer website, even though I am also aware that this is not without safety concerns. I know this is an unrealistic expectation at this point, but I dislike that the Google/Apple Stores have more trust, even though they regularly publish fake apps or apps with security/privacy issues.

Ultimately, publish on multiple channels regularly and let your users be aware of alternatives. Then they are enabled to switch when they need to, and it might also be easier for new users to recognize which release channels are official

source