Native App

Full Title or Meme

A digital Entity that is operating on a User Device, but is typically supplied by the Web Site or some Federation.

When discussing the use of the internet by a user, what is really meant is the Presence of the user operating an agent on an internet connection during some sort of Authentication process.
From the time of the authentication with the agent forward, the user's Presence is seldom verified unless some individual action requires reconfirmation of the user's Presence, which may vary from a physical gesture on the screen to a test of some biological feature of the user.
Typically the Native App will run on a User Device in the user's physical possession, but it is possible that the agent is running on a service in The Cloud.
The Native App may act like a browser and supply an HTTP user agent string, but it should not be considered to be a User Agent.
The Native App may act like a web server by registering Native App URI Handlers so that it will receive registered URLs entered into the browser.

Nearly any application running on a user's device is allowed to access the internet and claim that it represents the user. There is no built-in mechanism to test this assertion by an internet connected service. The internet was designed to connect computer systems, and that is all it can be relied upon to do.
Any Web Site that wishes to create a Persistent Identifier for a User will need to take responsibility for any necessary Assurance that the Native App has not been compromised by an attacker.
Most of the larger enterprises operating on The Web prefer to supply a Native App to the users device to improve the User Experience for that site.
At of 2020-06 the uptake of Progressive Web Applications] or [[Web App]s is increasing as it provides a better download experience for the user, but it is not able at this time to access the full functionality of the device, like the file system or the Trusted Execution Environment (TEE).
To be sure that the User's intent is expressed by the Native App appears to be an insurmountable obstacle.
Aners Rundgren's page describes of of the problems in more detail.

Certification of the Native App please refer to page Native App Security.
The Native App should perform all Authentication of the user by way of a browser (User Agent) selected by the user and running on the user's device using a trusted Identifier or Attribute Provider.
Pre Oauth Entity Trust describes a means to represent third-party application endorsement for health care applications. POET’s goal is to help consumers distinguish between applications that have an endorsement versus applications that have no pedigree (i.e untrusted and could be malicious).
Some sort of statement from the app developers about the app is required in the form of a manifest or Mobile Assurance Statement. (Note that the link will cause a download of the spec.)