Android password managers vulnerable to phishing apps

[Oliv_er]

Hi,

How are we looking with regards to this?

Android password managers vulnerable to phishing apps

I suppose it’s not an issue as autofill isn’t enabled.

Any comments?

Cheers,

Olivier

[mds08011]

See the response here:

Android phishing apps

Yes, any app that uses package ids from the play store to suggest autofill items to the user would be vulnerable to this, including Bitwarden. There is no other way to properly identify android apps that I am aware of and removing such feature would make autofill features largely useless to legitimate use-cases. As mentioned in several of the linked articles, tricking a user requires several actions to be explicitly performed by the user and is not something an app can just do automatically in t…