There specifically is enforcement by Apple with the new Universal Links feature (which that auth0 article talks about)<p>Without the enforcement, it&#x27;s arguably not secure unless the user is prompted &quot;do you want to open this link in Xyz.app&quot;<p>With the enforcement (you have to upload a special file to web server(s) for the domain(s) you want to &quot;claim&quot; for your app) third party&#x27;s cannot have the same level of integration (which is not limited to just auth - I&#x27;d love Twitter links to open in by native, non official client)<p>Honestly I think the &quot;solution&quot; already exists and just needs polish:<p>- Better password managers built in to browsers&#x2F;os&#x27;s<p>- MUCH better handling of private keys and client certs on user devices (add client cert syncing via iCloud Keychain for example)<p>- wider knowledge and use of 2fa systems