An old problem which never seems to be quite solved: how do you distinguish pieces of software on a platform that have a legitimate need to request a password from you, from those which don’t?

https://www.schneier.com/blog/archives/2017/10/impersonating_i.html