The aim is therefore to remove the reliance on it being genuine. If you don't have passwords then there is no passwords to steal.

I think that's Android/iOS responsability.

In the proposed implementation above, the _only_ piece of information that a user enters inside the web view is a username. The user must then use the native Mondo app on a previously-authenticated device to complete the OAuth flow. The Mondo app could also require biometric (ie. Touch ID) authentication.

While a malicious application can inject JavaScript to intercept the username, this alone is useless to an attacker.