While this is a very special and interestng use of this attack vector, I do think it often gets too much focus, mostly because it’s ignoring a much bigger problem: The average person doesn’t even know what the legit URL of a website should even be, and that starts with the TLD. Was it .com? Or maybe .org? Maybe some country-TLD or maybe one of the thousands of new TLDs like .world or .finance? If you don’t have a perfect memory of every URL of all the websites you’re using, being able to inspect the exact shape of each letter isn’t going to help you.

Exactly. This was less important before the internet got ubiquitous, but nowadays, when manufacturers can screw you remotely, it’s very important.

This kind of vertical integration, where a single entity controls both hardware and software shouldn’t exist.

Just tried it for a bit. Looks pretty sleek and has some nice features, but it seems like it’s not open-source, which is something I’d like to avoid.