search

w3c / manifest-app-info

Web App Manifest - Application Information
https://w3c.github.io/manifest-app-info/
Other
27 stars 14 forks source link

Can we certify a "Publisher"? #3

Open aarongustafson opened 4 years ago

aarongustafson commented 4 years ago

This is a property for apps in every app store. Having it just be a string in the manifest creates a huge security risk (in terms of apps being able to misrepresent themselves as being from a trusted company, such as a bank). Possible alternatives:

  1. Validate via SSL Certificate
  2. Validate via Domain Registration
  3. ??
marcoscaceres commented 4 years ago

Probably the store wants to prove the identify of someone by getting them to put a secret somewhere on the server (like google does) and getting them to send actual real documentation to prove identity (like a certificate authority). This might be outside the scope of the manifest.