Daily iOS
Security

Deep link security

A feature opens the transfer screen from a deep link on the myapp://pay scheme with to=<account>&amount=<amount> parameters. What attacks does that allow?

How would an interviewer hear this answer? You'll see whether they'd move on, dig in, or say no, and which sentences would trip you up. Your score doesn't change.
See the short answer

Another app can register the same custom scheme and intercept it, and because anyone can build the link, a phishing link with forged to and amount values can drive a transfer nobody confirmed.

Share a question