I am building an Apple iOS application that will have the following flow:
- A user completes registration from the web.
- Upon completion of registration, a link is sent to his email.
- Once the link is clicked on an iOS device, my iOS app will be launched and will prompt the user for credentials.
The thing is another malicious app can register to the same URL scheme as my app. In such a situation, the malicious app can be launched instead of my legitimate app, and easily steal the credentials of my users.
What can I do prevent data leakage in this situation? (i.e. make sure that the malicious app cannot imitate my app and/or implement a mechanism that will enable users to easily differentiate between my app and the malicious app)
But all of them propose implementing a mechanism that will eventually enable the malicious application to completely imitate my application.