I feel like I am missing an important point here, I have been reading up a bit on the PKCE flow but something doesn't sit quite right.
How is PKCE secure on public devices? If I understand this correctly if you do not control the redirect url then anyone can pretend they are your app. Suppose the redirect is
localhost/foo, if you initiate the flow by exchanging a client-side generated secret and a clientid embedded in the client, what is stopping a malicious app from taking my clientid and redirect and pretending they are my app? The secret is dynamic so that is not a stopper, the redirect is available to anyone and the clientid is embedded client-side.
What am I missing?