I'm most concerned about how they accomplished what's described here:<p>> Apple says the fake Trezor app got through the App Store through "a bait-and-switch." It was called Trezor and used the Trezor logo and colors, but said that it was a "cryptography" app that would encrypt iPhone files and store passwords. The developer of the fake app told Apple that it was "not involved in any cryptocurrency." After the fake Trezor app was submitted, it changed itself into a cryptocurrency wallet, which Apple was not able to detect.
Sounds horrible but what was the user thinking? Why did they get a hardware wallet and hope to magically access that wallet without his hardware device? What would the hardware wallet be doing if this was possible?<p>Didn't they find it fishy that they were inputting their recovery phrase into the app? This is why I tell friends to just keep it in Coinbase. The odds of Coinbase being hacked and going insolvent <<<<<< non-technical user messing up in a myriad of different ways.
Original post had paywalled source: <a href="https://news.ycombinator.com/item?id=26638131" rel="nofollow">https://news.ycombinator.com/item?id=26638131</a>