[HN Gopher] Instagram can track anything you do on any website i...
___________________________________________________________________
Instagram can track anything you do on any website in their in-app
browser
Author : the_mitsuhiko
Score : 779 points
Date : 2022-08-10 17:18 UTC (5 hours ago)
(HTM) web link (krausefx.com)
(TXT) w3m dump (krausefx.com)
| jeffwask wrote:
| Awful but not suprising. Their apps are effectively spyware at
| this point.
| pid_0 wrote:
| joshstrange wrote:
| I was super confused by this since to the best of my knowledge
| SFSafariViewController blocks anything like this, you, as a
| developer, cannot inject anything or peak into the view it
| creates. Then I got to the bottom and realized I was correct, but
| FB/Meta/IG/etc aren't using SFSafariViewController and instead
| using the older ways to embed a web view.
|
| Honestly I thought all other methods had been deprecated and had
| no idea apps could still make use of the less secure (for the
| user) options. Trust me, as a developer I've wanted to reach
| inside a SFSafariViewController many times to make my life easier
| but in the end I've just grumbled and assumed it's not possible
| and worked around it.
|
| I wish there was a privacy-safe way to get the best of both
| worlds but due to bad actors I doubt that will be possible. I
| need to look more into App-bound domains but I don't think even
| that will give me what I really wish for (a way for the page
| loaded in SFSafariViewController to tell my app something).
| Something like postMessage support for SFSafariViewController
| would be amazing and be safe privacy-wise I think since the
| contained page would need to support sending/receiving messages
| instead of just having code injected against their will.
| YourGrace wrote:
| Yes, developers are able to leverage WKWebview on iOS and a
| Webview on Android.
|
| One thing about both webviews is that there are callbacks with
| these implementations that developers can choose to open a link
| in the embed webview or not. It might be useful for
| privacy/security for Apple/Android to force developers to
| allow-list a domain (like iOS's Associated Domains) or such
| that an embedded webview can load (besides local html and
| files). It might be something in addition to the developer's
| callback.
|
| iOS WKWebview:
| https://developer.apple.com/documentation/webkit/wkwebview
| Android Webview:
| https://developer.android.com/guide/webapps/webview Associated
| Domains:
| https://developer.apple.com/documentation/Xcode/supporting-a...
| rdtwo wrote:
| Can you use an in-app browser to host a light weight proxy
| server? Thereby allowing a 3rd party to access anything behind
| the firewall as local traffic or pretend to be the machine.
| joshu wrote:
| i don't understand why apple allows in-app browsers.
| nkozyra wrote:
| You mean custom ones, right? WebViews are incredibly useful,
| but it definitely seems like implementing your own browser
| gives people a false sense of security, like they've been
| sandboxed when they haven't.
|
| What would be nice here is a permission requirement if you're
| injecting code into a browser view.
| replygirl wrote:
| since years ago apple added the little back button to return
| you to your previous app, even webview is dead weight. apple
| should only allow one, in some special context, that's so
| counterintuitive to implement that only frameworks e.g. react
| native can justify the effort
| dylan604 wrote:
| And yet, we're normally seeing Apple === BAD because they
| limit everything to just the one Apple thing. Am I actually
| seeing requests for Apple to limit willingly?
| bitwize wrote:
| Most of Hackernews doesn't understand why Apple is the #1
| tech company in the world -- they're still in the "no
| wireless, less space than a Nomad, lame" mindset.
| replygirl wrote:
| in 2015 i got an iphone for a job, then i made it my
| daily driver because i liked the restrictions. now my
| phones last four years instead of one
| dylan604 wrote:
| How is the walled garden allowing a phone to last for
| four years? Where you getting new phones because you
| polluted your non-walled garden device with so many bad
| apps that you chose to get a new device? Not really
| following your point, but maybe I am?
| replygirl wrote:
| i was getting new phones mostly because my devices were
| getting bogged down by android updates and capabilities.
| the os allowed developers to do more and more things, and
| offered more and more customization, faster than the pace
| of hardware improvements supported, to the point i'd have
| to get a new phone if i wanted something both up-to-date
| and fast. if i kept a phone longer much longer than a
| year, i'd have to worry about software updates as well,
| OR replace the OS and deal with instability.
|
| and i'm not talking about bad phones here -- htc one s,
| nexus 4, nexus 5, nexus 5x. admittedly, degradation of
| shitty NAND is still a factor in higher-end android
| phones, so it's not _all_ about the android ecosystem
| being a free-for-all
|
| an iphone xr will still run everything fine, including
| the latest version of ios. hundreds of dollars saved and
| a whole set of problems avoided over the life of the
| phone. i only replace my phones when they're smashed to
| bits now
|
| anecdote: someone in my family just had to replace their
| android phone because a software update caused the radio
| to stop working for calls. so the ecosystem issue is not
| just a userland thing
| dylan604 wrote:
| I'm on an iPhone 6s+, so yeah, I'm a fan of the not
| needing a new phone all the time. I am pleasantly
| surprised with each new iOS that my phone is still not
| deprecated. At that point, I will have to look at
| updating.
| joshu wrote:
| webviews for clicking arbitrary links in apps like instagram
| or gmail are absurdly restrictive. i lose my context,
| cookies, and regular tools (bookmarks are gone, sharing often
| overridden, etc)
| jhgg wrote:
| This is why https://developer.apple.com/documentation/safar
| iservices/sfs... exists and why the blog post advocates for
| using it.
| wonderbore wrote:
| That was a great update, but still not a true browser. No
| tabs, no bookmarks. Why should the website be restricted
| to one tab? Just open Safari and be done with it.
| joshu wrote:
| exactly
| fleddr wrote:
| They're supposed to be restrictive as to not confuse the
| user. An in-app browser isn't there to give you a full
| browsing experience, it's there to do a quick web-only task
| that somehow cannot be done in the native app itself.
| navanchauhan wrote:
| Do you want to cripple the entire app industry? Apps built
| using React Nativ / Flutter e.t.c use the WebView to render
| themselves. So they're basically already running "in-app
| browsers"
|
| But then how do you differentiate when the app is rendering its
| own view rather than another website? You could apply some
| restrictions like <iFrame> has nowadays where you need extra
| security privileges (I think) to render pages / execute scripts
| not on the same domain
|
| Otherwise you can always open safari from all of these in-app
| browser views and they could implement a toggle which forces
| all of them to be opened in Safari automatically
| rullelito wrote:
| It's a big difference between browsing your own pages in-app,
| and opening any link in an in-app browser and tracking it.
| joshstrange wrote:
| I think the clear answer is to only allow local/whitelisted
| domains that you can prove you own. I work on
| Capacitor/Cordova apps regularly and only allowing local code
| would allow for them to continue to work and close this
| loophole. Anytime I open an external page I do it in
| SFSafariViewController which doesn't have the ability to
| inject code or snoop.
| joshu wrote:
| it's a bad experience for opening external links. i don't
| care that it's not easy to get to.
|
| and no, not all apps do this. tiktok does not offer an
| escape, and instagram hides it behind two clicks.
| supermatt wrote:
| Thats not how react native or flutter work at all. They use
| native views, not a browser. You are likely thinking of
| cordova (phonegap) et al.
| atwood22 wrote:
| At the very least webviews should treat contents as a subframe
| and respect the frame option headers.
| oconnor663 wrote:
| Last I heard (years ago), iOS forced everyone to use Safari for
| webviews, which lots of people also complained about. Did that
| change? Or is the Safari webview the subject of this story?
| jclardy wrote:
| Every webview on iOS is Safari internally. The issue is if an
| app presents a webview, they can inject whatever javascript
| they want. This is what allows frameworks like Ionic to work
| in the first place, the webview runs the "app" and any
| interface back to the OS is communicated through a bridge to
| the native world.
| darknoon wrote:
| Safari webview (WebKit) is what it's describing
| pantulis wrote:
| The key aspect here is that Instagram's app is using a
| Safari Webview but somehow it is injecting its own tracking
| pixel on the HTML body wether the target website had it or
| not.
|
| Which honestly does not surprise me, what surprises me is
| that Apple allows this. I think there was a time where
| certain Javascript capabilities were present in Safari but
| not in Safari Webview and there was certain outrage.
|
| Perhaps a solution would be to run the webview through
| Safaris content blocker engine?
| saagarjha wrote:
| To what? Disable the ability to inject JavaScript into
| the web view?
| pantulis wrote:
| Yes. Is there a legitimate use case for injecting
| arbitrary Javascript by the native app? (Honest question)
| rawling wrote:
| Apps that use html for their UI and JS hooks to trigger
| touch ID, access the keychain etc.
| sitzkrieg wrote:
| its the same. any browser (or app otherwise) on entire system
| has to use it for web rendering
| mikewhy wrote:
| If an app uses the non-OS supplied web view I just assume they're
| doing nefarious things.
|
| Coincidentally the only apps I have that don't use the OS
| supplied web view are from Meta.
| hnburnsy wrote:
| I'm confused I thought Apple only allowed web browsing via
| Safari...
|
| "2.5.6 Apps that browse the web must use the appropriate WebKit
| framework and WebKit Javascript."
|
| If apps can use their own in app browser, why can't say Brave for
| example, create an app that does very little, except it browses
| the web with its own in app browser?
| superjan wrote:
| This just forbids developers to write their own browser engine.
| It is OK to use the iOs provided webbrowser as a control in
| your app.
| EGreg wrote:
| I once wrote an email to Steve Jobs, saying that operating
| systems like MacOS and iOS should have a secret phrase or icon
| that they show to you whenever they show a system-level security
| dialog. (And of course implement the same restrictions on
| screenshots of that dialog as they do for movies.)
|
| Because otherwise, an app can totally fake the interface of a
| security dialog. The only way you know, these days, is that
| password managers and cookie jars work with the "approved" sites,
| but they can simply show you a site that doesn't require those,
| and then fool you into entering your passwords!
|
| Steve never replied to me. And Apple never implemented it.
| Mordisquitos wrote:
| Fun fact, the Spanish word for password, _" contrasena"_,
| originally implied this behaviour as _" sena"_ --> _"
| contrasena"_ ("sign" --> "countersign").
| BonoboIO wrote:
| The sheer number of traffic and data ... if one company knows if
| we are heading into a recession it's Facebook!
| grishka wrote:
| Ah so _that 's_ why they insist so much on opening every single
| link in their crappy in-app browser. I decompiled and patched
| Instagram for Android, and I did try, among other things, to
| bypass that browser (and gave up because my approach somehow
| mysteriously broke navigation in the app), but the thought that
| they're using it to track you has never once crossed my mind.
| mtlmtlmtlmtl wrote:
| There is no reason for in-app browsers to exist besides tracking
| really, so this isn't all that surprising. The only effect of
| removing them entirely would be that stuff just worked better in
| general.
| cloudyporpoise wrote:
| The battle for control continues. I started noticing this
| personally when using social media and took note of the fact that
| the browsing was still being done within the app when clicking on
| an external link.
|
| The war on control of data continues on.
| asadlionpk wrote:
| I hope Apple doesn't disable JS injection in WKWebViews in
| response to this. JS injection is the (only?) way to call native
| Swift methods from JS ie. bridging.
|
| I am not sure what the solution here is. Maybe only allow
| injection to sites you control (via apple association file).
| nofunsir wrote:
| I hope they do.
| AtNightWeCode wrote:
| Should only be allowed on domains one owns. Could be solved by
| DNS records or certificates.
| asadlionpk wrote:
| Yup, apple association file is Apple's method of proving
| ownership to a domain.
| throwaway290 wrote:
| Wait, websites can call native Swift methods from JS?
| Linkd wrote:
| Certainly. See https://developer.apple.com/documentation/webk
| it/wkscriptmes...
| _rend wrote:
| Only intentionally, via setup from a hosting app. If an app
| uses a WKWebView to display web content, it can use
| WKUserContentController[1] to inject scripts and additional
| content into the page dynamically, and can inject functions
| into JS[2] which will trigger native callback handlers when
| called.
|
| If your app uses the JavaScriptCore[3] framework to run JS in
| a VM in-process directly, you have even more options for
| interfacing between JS and native code.
|
| Note that this has to be explicitly hooked up by the app
| (i.e., none of this applies within, say, Safari).
|
| [1]: https://developer.apple.com/documentation/webkit/wkuserc
| onte...
|
| [2]: https://developer.apple.com/documentation/webkit/wkuserc
| onte...
|
| [3]: https://developer.apple.com/documentation/javascriptcore
| Spivak wrote:
| Short answer: yes
|
| With the appropriate libraries you can use JS to call Swift
| and Obj C code.
|
| Long answer: no
|
| All it really means is that the JS and Swift/Obj C can pass
| data between each other and the library is set up to parse
| that data and call the appropriate code. It's just an
| automatic RPC.
| jedberg wrote:
| Apple can just disallow in app browsers in the store policy.
| Require apps to call out to the default external browser.
| asadlionpk wrote:
| The line is a bit blurry there. from a webview-based apps to
| just in-app browsers that opens when you tap a link in an
| app.
| jedberg wrote:
| Sure but since the App Store is human review, they can tell
| the difference between a web view and an external website.
| Or just require the app to only call web views on their own
| domain or a whitelist of domains they submit with the app.
| greenie_beans wrote:
| i always just assumed this and used the app accordingly. but glad
| there is some proof.
| smm11 wrote:
| I already fixed it, by not using Instagram.
| captaincrunch wrote:
| I generally assume that if I am using a browser IN ANOTHER APP,
| its tracking it - or could. Not hard to do
| andix wrote:
| It would be interesting if this violates rights of the website
| owner the user is visiting. I known that embedding content of
| other websites into your own via an iframe can be a copyright
| violation. And what Meta does here is more or less like an
| iframe.
| AtNightWeCode wrote:
| I believe so. Copyright and TOS of the sites. Copyright also in
| the sense that content have been changed. This should be on
| pair with banner swap techs.
| upupandup wrote:
| It isn't. By that logic any browser is liable for violating ToS
| of websites, which btw isn't the law and you are not obligated
| to follow anyhow.
|
| This of course is a different case for corporations with a
| dedicated legal team.
| andix wrote:
| First Instagram is not a browser.
|
| And second the browser manufacturer (usually) doesn't make
| any money by tracking their users. They provide them with a
| tool, a browser.
|
| There is the browser Brave, that replaces ads on websites
| (and makes some profit with that), and there are some serious
| legal issues coming with that.
| upupandup wrote:
| My god...you are like the 8th inactive HN user I saw that
| suddenly springs into action to suggest Brave or post links
| to Brave
|
| I think we can see whats really going on here. Any chance
| to drop or mention Brave, after not being active for weeks
| or months, suddenly congregate to push Brave browser
|
| Dang really needs to do something about this type of
| astroturfing
| andix wrote:
| what are you suggesting? I didn't recommend Brave to
| anyone, it's just a comparable example to this issue. You
| can look up their legal issues and build your own opinion
| based on that.
|
| And why are you suggesting i'm an "inactive user"?
| avalys wrote:
| Seems like Instagram _is_ a browser.
|
| The right you seem to be claiming is "you can't render my
| website in your app if I don't like your app", and that's
| not how it works.
| andix wrote:
| So why are iframes then not allowed by some legislations?
| Because an iframe is also "just a browser".
| bacan wrote:
| In-App browsers have always been a security nightmare. Similar
| issues exist with Electron apps as well.
|
| But developers continue to use them as HTML + CSS + JS is the
| easiest way to develop a graphical dynamic UI, for a newbie. Many
| schools & colleges even teach basic HTML, CSS & JS, so the
| barrier to entry is very low.
|
| I am not sure what a good solution here would be, but maybe we
| could start by limiting access. Or another way could be to have
| some way to convert the rendered UI to compiled binary code
| xfitm3 wrote:
| Good call out on Electron apps, I try to avoid Electron as much
| as possible. I use Slack's web interface for example.
|
| I never made the connection until you brought it up, but yes,
| Electron apps are just like using Webkit on iOS. Abstracting
| UI/UX to a browser engine which has identical security pitfalls
| to a browser but with far less control and inspection
| capability.
| chadlavi wrote:
| It's really concerning that everyone treats their children like
| prisoners. Your kids are gonna find a way to look at what they
| want anyway, why make it MORE appealing to them by making it
| verboten? Are you protecting them or are you controlling them?
| twodave wrote:
| Some kids (and adults) literally aren't capable of impulse
| control. It's actually nice to be able to hand that control
| over to somebody else in some cases. And, as a parent if I know
| my child struggles with this it would be negligent of me to let
| them harm themselves knowing they can't stop themselves. I have
| four children and if there is any generalization about raising
| kids that I have learned it is that each child has different
| needs.
| notatoad wrote:
| >I've disclosed this issue with Meta through their Bug Bounty
| Program
|
| lol. and this is why companies can be hesitant to run bug bounty
| programs. it's not a place to complain about things you don't
| like. Meta/instagram has made a design decision here. just
| because you don't like it, doesn't mean it's a vulnerability.
| [deleted]
| lrvick wrote:
| Remember this is the same company that just gave police DMs
| that aided in an abortion investigation. If those had been end
| to end encrypted that risk would not have existed, but they
| made a business decision to leave the application vulnerable to
| spying for profit reasons. That is a vulnerability, in the same
| way we call it a vulnerability when an entity man-in-the-
| middles a browser to spy on people.
|
| Personal user browsing or communications leaking in plain text
| to private companies without explicit and obvious user consent
| puts users at risk, and is a vulnerability. It just so happens
| to be one arising from malicious profit seeking behavior that
| happens to be the status quo.
|
| Not having https was once the status quo, and a boon for
| corporate spying, but we call that a vulnerability now because
| the abuses became too big too ignore.
| 202206241203 wrote:
| Yes, but people love that, otherwise e.g. freemium and ad-
| driven games would not exist.
|
| Consumers have a payment-avoiding behaviour as a status quo.
| lrvick wrote:
| This comes across as victim blaming.
|
| Users are given the choice to accept risks that are buried
| on page 7 of privacy policies only a lawyer could
| understand the tricks in.
|
| Services knowingly endangering unknowing users for money
| should be like cigarettes and be forced to say on the
| signup page in big bold text they can and will sell user
| data to anyone, including law enforcement.
|
| Users largely think free services are like public libraries
| and do not default to expecting they are being exploited
| for money. Element, Wikipedia, and duckduckgo exist for
| free without selling user data so it is not a given that
| exploitation is always present in free services.
| noduerme wrote:
| This isn't a consumer choice issue. People love morphine
| too, it doesn't mean Amazon can sell it to them. If Apple
| enforced its own rules in this case, Facebook would just
| have to act like any other developer and find some revenue
| streams that comply with established privacy norms.
| wmeredith wrote:
| > this is the same company that just gave police DMs that
| aided in an abortion investigation
|
| They were served a warrant. I'm no friend of Facebook/Meta,
| but any company served a warrant is going to turn over what
| they have.
| [deleted]
| sharkjacobs wrote:
| Keep reading, you might be missing the point, the paragraph
| continues on after that sentence
| woodruffw wrote:
| I don't think the GP is saying that Meta should have
| ignored a lawful order. I think they're saying that they
| shouldn't have put themselves in the position of being
| _able_ to render that information, and only have done so
| because it 's profitable for them to do so.
| wonderbore wrote:
| It's really painful to see all of these encryption holes
| in every product we use daily. Apple claims privacy, yet
| your whole phone sits unencrypted on their server ready
| to be served to anyone who asks (assuming you back up
| your phone to iCloud)
| woodruffw wrote:
| My understanding is that iCloud backups are encrypted[1].
|
| [1]: https://support.apple.com/en-us/HT202303
| wonderbore wrote:
| Encrypted but they have the keys so they can serve it to
| anyone who asks. That's why "end-to-end" is subsequently
| mentioned as an "additional" step for certain data. It
| should all be end-to-end like iCloud Keychain is, at
| least on demand.
| zip1234 wrote:
| Well, one can go ahead and enable End-to-End encryption in
| Facebook Messenger now:
| https://www.facebook.com/help/messenger-app/786613221989782
| samstave wrote:
| > _just because you don 't like it, doesn't mean it's a
| vulnerability._
|
| Technical Vuln or Business Vuln?
| vade wrote:
| It is a vulnerability. You the user are just vulnerable to
| them...
| [deleted]
| sleepyhead wrote:
| It should be reported as a vulnerability. To Apple. Yes they
| made a decision for this as well but a decision can still be
| reported as a vulnerability.
| riazrizvi wrote:
| Only Instagram? Every app maker who makes an in app browser can
| see what you do, that's the point of embedding it. And why not?
| You arrive there because of a link in the container app you
| clicked on. They want to see what you do with the link they gave
| you. Otherwise only Google/Apple can see what you do with it.
| Someone can see what you do with the link no matter what.
| altairprime wrote:
| Not necessarily. If they're using a WKWebView, they can't see
| what you're doing, which is why Safari Autofill remains enabled
| in _some_ but not _all_ app-embedded web views.
| senttoschool wrote:
| No wonder. I recently opened a link on Instagram and the
| website's responsive elements were completely broken. Then I
| opened the link in Safari and it worked fine.
|
| Does this script injection break Apple's ToS?
|
| I thought Apple required Safari/Webkit for all in-app browsers?
|
| Zuckerberg has no shame.
|
| PS. I hate in-app browsers. They don't sync with my main browser
| states such as authenticated sessions.
| yieldcrv wrote:
| > Does this break Apple's ToS? I thought Apple required
| Safari/Webkit for all in-app browsers?
|
| Doesn't apply to special companies.
| runevault wrote:
| Apple has been fine doing things that hurt FB, see not giving
| them special privileges' around the Ad tracking permission
| changes that were added to iOS.
| ffpip wrote:
| > Does this break Apple's ToS? I thought Apple required
| Safari/Webkit for all in-app browsers?
|
| They are still using Safari/Webkit, but just injecting a script
| into every page.
| pantulis wrote:
| Is there a legitimate use case that could explain why Apple
| is allowing this?
| navanchauhan wrote:
| It probably is still running Webkit underneath with some
| additional JavaScript to track everything
| noduerme wrote:
| It would have to be. Apple's main bugbear seems to be anyone
| embedding Chrome or Firefox on iOS.
| kube-system wrote:
| > PS. I hate in-app browsers. They don't sync with my main
| browser states such as authenticated sessions.
|
| Seems like that's probably a good thing :)
| mh- wrote:
| _> They don 't sync with my main browser states such as
| authenticated sessions._
|
| And this is exactly why Apple gives them their own cookie jar.
| The alternative would be [more of] a security nightmare.
| samstave wrote:
| > _They don 't sync with my main browser states such as
| authenticated sessions. _
|
| Under what circums do you want this?
| anamexis wrote:
| All the time. For example: open a link in Gmail, forget that
| I am in the in-app browser, and log into a service.
| senttoschool wrote:
| > Under what circums do you want this?
|
| Click on "Sign In/Up with Google". Opens in app browser. Not
| logged in even though I'm with Safari. Type email. Type
| password. Get password wrong. Type password again. Get
| text/email with 2FA code. Every single time.
|
| Or Gmail app. Click link. Open in-app browser. Not logged in.
| samstave wrote:
| I am not a fan of the "Password Fabric" - if you are, you
| are not my friend...
| sneak wrote:
| You shouldn't be typing passwords in 2022, get a password
| manager.
| senttoschool wrote:
| Not paying a subscription for a password manager. And
| don't want a single point of failure for all my accounts.
| sneak wrote:
| Self-host vaultwarden, it's free, and it syncs to all
| your devices so you have a bunch of backups.
| upbeat_general wrote:
| I've had to log into google/fb/etc so many times through in-
| app browsers when I'm already logged in in my main safari
| browser.
| [deleted]
| dzikimarian wrote:
| I'm surprised that so many people write "yeah, any in-app browser
| can do that - nothing to see here".
|
| Anyone can potentially steal your wallet, so we shouldn't point
| out when someone actually does? Especially when there's hard
| evidence in article?
| benbristow wrote:
| One thing I've noticed is that content-blockers/adblock don't
| seem to work within the Facebook/Instagram etc. in-app browsers
| so I usually end up jumping out of them anyway.
| vuln wrote:
| Yup same. I jump out as soon as it attempts to load and I have
| the ability.
| saagarjha wrote:
| Content blockers only work in Safari and
| SFSafariViewController.
| graham1776 wrote:
| I've meant to write a blog post about this, but here goes: In-app
| browsers allow users to view inappropriate content, often against
| the wishes of sensitive individuals. People especially at risk
| for this include addicts and children.
|
| Nearly every app, even "safe apps" including children-rated apps,
| allow access to an in app browser. Even when iOs has locked down
| all access to Safari, a parent has removed access to all the
| "apparent" unsafe sites, there are still ways to access the
| unfiltered internet inside of these safe apps.
|
| How? Usually buried in App Settings. Almost all apps use some
| instance of an in-app browser to (lazily) reference thier privacy
| policies, EULAs, or TOCs. A buried link leads to a homepage,
| leads to an instagram link, leads to an unfiltered internet. Yes
| they are long, inefficient paths to reach the internet, but
| curious (or motivated) individuals or children will use almost
| any app to reach the internet. Even boring apps like MS Teams or
| adding a Gmail account to iOS mail uses a secret in-app browser.
|
| This obviously presents a problem: should developers restrict any
| and all app access to in-app browsers, or leave policing to
| individuals/parents? An easy approach is to disable the in-app
| browser functionality in iOs, but obviously with grave cost to
| developers. At the same time, at what cost is in-app browser
| functionality being implemented.
| davet91 wrote:
| The in-app browsers could use a domain whitelist if parental
| controls are turned on.
| adaktix wrote:
| It shouldn't be a parental controls thing for IG, it just
| needs to be made so when you're using an in-app browser,
| you're using it for one reason, whatever site you clicked on.
| Leaving the domain ends the process or opens in another
| browser.
| graham1776 wrote:
| That could be an "easy" fix where you could disable use of
| in-app browsers through Screen Time options.
| yowzadave wrote:
| Shouldn't an in-app browser whose sole purpose is to read an
| app EULA/TOC/etc. always employ a domain whitelist,
| regardless of parental controls?
| polote wrote:
| A feature doesn't become a problem because 1% have an issue
| with it (people who use parental control).
|
| The internet is the internet if you want to restrict what
| people can see on the internet the only solution is to not have
| access to it at all
| bigfudge wrote:
| Do you have kids? It's really not easy to withdraw all
| internet access without substantially disadvantaging them.
| But I don't want them reading 4chan either. Anything which
| makes that less likely without fundamentally breaking things
| is welcome to me.
| chadlavi wrote:
| As a child of the 2000s: just let them look at the
| horrifying underbelly of the internet. One trip down
| grossout lane isn't going to undo all your parenting and
| make them some kind of perverted monster.
|
| Children aren't prisoners.
| mschuster91 wrote:
| Back in the early 2000s we didn't have people actively
| recruiting young frustrated men into incel and far-right
| terrorist groups though. We didn't have people thinking
| it was cool and edgy to make jokes about gassing Jews.
| Hell even the pedo/grooming problem wasn't much of a
| thing. Yes there was porn and vile gore floating around
| and you had to take care to not fall victim to dialers
| changing your dial-up information to bleed your phone
| bill... but that was all in all harmless.
|
| These days, the amount of utter idiocy is just
| unimaginable, "eternal september" style. You join some
| random online game discord and whoops half the talk is
| about rape fantasies, n-bombs and other kind of sickening
| behavior. Let it slip you're a girl and you'll get
| _flooded_ with wiener pics, "cum tributes", disgusting
| fantasies, doxxing attempts, or flat out hate for
| standing in the way of someone. Go on Youtube, watch a
| couple of videos and your suggestions have antivaxx
| bullshit or "shocker videos". Games for children are
| _filled_ with barely disguised pedos and "moderation"
| doesn't do shit. Not exactly an environment many people
| want to expose their children to.
| LordDragonfang wrote:
| Maybe not in the "early 2000s", but you'd have to be a
| child of the _90s_ , not the "2000s", to have missed it,
| because all of that was around by the second half of the
| decade (with perhaps the exception of the far-right
| recruitment, which didn't fully hit its stride until the
| early 2010s).
|
| It's been out there since the beginning; the problem is
| not the access to it, it's relationship with the
| internet. Back in the day, you were told to never give
| your real name online, now you're expected to type it
| into forms three times a week, while you have a public
| profile of all of your picture that anyone can look up
| while an algorithm serves it to the whole world. And yes,
| some of it is because kids are getting access to this
| world as toddlers when we weren't able to get there until
| early teens or the end of grade school at least. Kids
| need to be taught digital safety more than we need to
| continue the losing fight about securing access. Kids are
| smarter and more motivated than you are, they'll find a
| way around it.
| Zababa wrote:
| > But I don't want them reading 4chan either.
|
| I don't think access to 4chan is going to fundamentally
| change who your kids are.
| FabHK wrote:
| I think you accidentally a word.
| Zababa wrote:
| I did, thanks. For the record, my post was missing
| "change" before.
| franga2000 wrote:
| What do you think is more likely? That your child will
| stumble upon, correctly identify and successfully exploit
| an in-app webview, or that they will simply type "4chan"
| into Google on a school/library/friend's computer/phone?
|
| Unless they are under constant supervision, they will find
| a way to access what you're hiding from them. And if they
| are, well then you don't need technical blocks in the first
| place, do you?
| rahkiin wrote:
| It is interesting how this would apply for custom browser
| engines in the future of iOS.
| CharlesW wrote:
| This class of security problem is also a great reason to
| never allow custom browser engines.
| postalrat wrote:
| How about services like luna, stadia, etc which can render
| any sort of interactive content (typically games)?
| smoldesu wrote:
| ...why wouldn't it be possible? iOS has application
| sandboxing, just drop all DNS requests for the webview
| that's outside a developer-defined namespace. I'm sure
| someone at Apple could find a better way to implement it,
| but we shouldn't accept lame excuses like this. Apple has
| 200 billion dollars in cash, this is not an advanced
| problem space.
| happyopossum wrote:
| Then the app can use DOH, or tunnel DNS requests over
| something else - a non-safari browser engine wouldn't
| have to use system DNS by any means...
| jamespo wrote:
| I thought non-safari browser engines were banned
| als0 wrote:
| They are. This is a hypothetical discussion.
| xfitm3 wrote:
| Doesn't the harm of surveillance outweigh the harm of viewing
| "inappropriate content"?
|
| Think of the addict is a new one, but I am automatically
| suspicious any time someone cites child protection.
| j2bax wrote:
| Why don't you just make sure there are no unsavory links on
| whatever page you are using the in-app browser for and
| disable/hide the address bar so they can't just jump onto the
| open web? Seems like you can have your cake and eat it!
| CodeSgt wrote:
| I'm glad to see someone mention addicts. I feel as if internet
| addiction, and especially subsets of it such as porn addiction,
| aren't given enough weight by either the addiction treatment
| community or the technical community.
|
| Before someone accuses me of being a conservative religious
| zealot as tends to happen when anyone denounces porn, I'll say
| that I'm far from a puritan and am extremely liberal in my
| social views. That said, I firmly believe that easy access porn
| is one of the worst things happening to the young men and women
| today. I (23) know many men around my age who suffer from
| chronic porn addictions to the point that it severely impacts
| their ability for form real relationships and median age of
| first exposure is getting lower and lower.
|
| It's an absolutely crucial issue that no one seems to be
| talking about or taking seriously.
| Zababa wrote:
| > It's an absolutely crucial issue that no one seems to be
| talking about or taking seriously.
|
| Most men communities talk about it in one form or the other.
| However, most men communities on the internet are usually
| close in one form or another to the right politically.
| CodeSgt wrote:
| I suppose I should have said it's not being talked about by
| any mainstream authorities or outlets in the same way a lot
| of women's or equity issues are (not to say porn isn't also
| a women's issue, it very much is, but seems to
| disproportionately impact men).
|
| It is a shame that any group which advocates men's issues
| tends to get labeled as right-wing or incelish, which then
| attracts those types and makes those labels a reality. And
| of course many were admitedly that way from the start.
|
| Edit: And to add to this, being right _or_ left leaning isn
| 't inherently bad. And maybe this is my personal bias
| coming into play here, but I find that people are much
| quicker to associate right-leaning movements/communities as
| "bad" than they are left-leaning ones. Again I accept that
| could be personal bias and it isn't a hill I'd die on.
| Zababa wrote:
| I share the same view of the situation as you. A
| consequence of the increase in demands for justice,
| political correctness, and stuff like that seems to be
| that every community has to be focused on a oppressed
| group or it will be considered right-wing and thus
| attract people like you said.
|
| The incel label is a good example of how bad men are
| treated sometimes. If you treated poor people like this
| by saying they're involuntarly not rich and then
| proceeded to say that it's mostly their fault because
| they don't work enough, think they can just show up to
| work, do their job and become rich, shouldn't expect
| money to be given to them, most people would react by
| saying that you're wrong. And when some parts of the
| population have trouble having sex/companionship like
| some trans people, it's called discrimination. But the
| same rules don't apply to incels it semms.
| majormajor wrote:
| My recollection of the term incel is that it was a self-
| applied label, not one created from outside the group
| like your "involuntarily not rich" hypothetical. (Even in
| that example, though... who's going to tell you you're
| wrong if your theory is "nobody should simply expect to
| get rich for showing up and not putting in the work",
| exactly?)
|
| As to whether or not that group is popular... this is an
| interesting one since the bonding factor is a lack of
| relationship success (which is closely related to, but
| not the same as, popularity) in the first place. But if
| you look at a lot of how the group that has gathered
| under that label interacts with the rest of the
| population... it's hard to say it's just something like
| mocking them for not being able to get laid. There are a
| lot of frankly offensive and violent theories pushed by
| people out there.
|
| It's deeply ironic actually - "I'm not having sexual
| success, I'm going to start listening more to other men
| who also have the same problem, _they 're_ the ones who
| will be able to tell me about women." Back when it was a
| more ironic, non-violent "foreveralone" meme I was in the
| club... it wasn't increasing my exposure to _men_ that
| eventually got me out of it.
| d110af5ccf wrote:
| You claim to be extremely liberal in your social views but
| then in the next breath make the assumptions that difficulty
| forming relationships today is significantly greater than in
| the past and further that this fact is due to effects that
| are caused (ultimately) by viewing porn. Those are both very
| socially conservative viewpoints and I have yet to find
| scientific data (or anything else I'd consider even remotely
| reliable) that back either of them up, particularly the
| second one.
|
| If I were to accept (purely hypothetically) that it is
| significantly more difficult for many people to form
| relationships today then how do you suppose to show that this
| change is due to porn instead of, say, the prevalence of
| dating apps such as Tinder? Or any number of other factors
| including things like job stability, housing prices (and thus
| perceived security of living situation), and where people
| choose to spend their free time (for example going out on the
| town in the past versus perhaps doomscrolling twitter and
| watching netflix).
| freedomben wrote:
| I'm not GP, but you first say:
|
| > _Those are both very socially conservative viewpoints and
| I have yet to find scientific data (or anything else I 'd
| consider even remotely reliable) that back either of them
| up, particularly the second one._
|
| but then go on to yourself list many probably reasons why
| that's the case:
|
| > _how do you suppose to show that this change is due to
| porn instead of, say, the prevalence of dating apps such as
| Tinder? Or any number of other factors including things
| like job stability, housing prices (and thus perceived
| security of living situation), and where people choose to
| spend their free time (for example going out on the town in
| the past versus perhaps doomscrolling twitter and watching
| netflix)._
|
| Completing a study to prove GP's claims is a herculean
| effort that may not even be possible due to ethical
| concerns. (i.e. you'll have to take a person who has never
| been exposed to porn and then get them addicted, so you can
| see if it ruins their life).
|
| Any claim without data should definitely be looked at
| skeptically (including in this case), but it's also
| important to remember that absence of evidence is not
| evidence of absence.
|
| Also there's a lot of life experience out there of people
| who will tell you that they have a porn addiction that is
| causing them problems with relationships. One of my friends
| just got divorced from his wife of 20 years because he has
| developed a porn addiction and won't give it up or get any
| treatment (his wife is not ok with it).
|
| I'm about as socially liberal as they come, (and I would
| never support a ban on porn nor pretty much anything, but
| that's a topic for another day), but I've seen and heard
| way too many anecdotes about the devastation that porn can
| have on a person to ignore it.
|
| I don't think there's a big difference between a social
| conservative (who typically want to use government force to
| restrict access to "bad things") and someone who sides with
| liberty and tolerance but would advise friends and family
| not to do "bad thing."
| flappyeagle wrote:
| What does it mean to be addicted to porn? Daily viewing?
| Hourly? Constant?
| elwell wrote:
| I feel like addiction is a complicated label; this is a
| natural[0] desire. If it is agreed to be destructive to the
| pursuit of forming healthy relationships: any amount is
| harmful, or at least the start of something that will be
| more and more harmful.
|
| [0] - natural like how we crave sugar for our health, yet
| harmful like I eat candy all day
| freedomben wrote:
| Just my opinion of course, but (like drugs and alcohol)
| putting a reasonable and generic metric on it is really
| hard, so I would instead ask generic questions that I would
| ask about other things like:
|
| 1. Do you find yourself craving it?
|
| 2. Do you continually feel the need to increase your
| intake? (i.e. developing a tolerance)
|
| 3. Would you be embarrassed if a like-minded friend knew
| about your habit?
|
| 4. If you were suddenly cut off from it for a few days, how
| would it make you feel?
| CodeSgt wrote:
| Typically viewing to the detriment of your
| emotional/mental/physical health. If you consistently
| choose porn over real intimacy or if you overly desensitize
| yourself (porn-induced ED is a real, and quite common
| thing). The biggest concern is choosing porn over physical
| intimacy/attempts at physical intimacy. It's super easy for
| someone who maybe already isn't a social superstar to just
| find themselves choosing the easy option of porn rather
| than forcing themselves to go out and put effort into
| meeting people.
| michannne wrote:
| We used to exploit these types of paths when school IT admins
| didn't know how to filter traffic properly but knew to block
| proxies.
| LegitShady wrote:
| There was a period of time at my high school where we would
| compile a default browser app in Borland c++ and it would let
| you access whatever it wanted. They noticed because they got
| proper filtering after that...
| t8ty2evj wrote:
| qwertox wrote:
| I think on Android they could use Chrome Custom Tabs [0]
| instead of WebViews. IIRC this also protects the browser
| content from being accessed by the hosting app, but there is
| still a limited communication which is possible between the app
| and the tab.
|
| [0] https://developer.chrome.com/docs/android/custom-tabs/
| smoldesu wrote:
| Or maybe... just don't give your kids an iPhone?
|
| Seriously, using the internet/computers should be treated with
| the same level of caution as grown-up scissors or fillet
| knives; powerful tools, but they need training to avoid hurting
| yourself with them. If _this_ is what you 're worried about,
| why are you even giving them a small computer in the first
| place? Your kids will always be more cunning than your security
| policy (a hard pill to swallow for HN users), so control their
| access to technology unless you're ready to have a serious sit-
| down discussion about the internet, personal privacy, and all
| that jazz. Put yourself in their shoes; if you're given a small
| black brick with an indeterminate number of capabilities,
| wouldn't _your_ response be pushing it as far as it can go? I
| know that was my reaction when I was a kid, after buying a
| Pentium desktop at a garage sale.
| chinchilla2020 wrote:
| You don't have kids.
|
| Your child would be the only one at school with no phone and
| probably be pretty embarrassed about it.
| Minor49er wrote:
| I wish this was still considered to be common sense
| ars wrote:
| You can't live in today's world without a phone.
|
| All the mechanisms of the past that were geared for this no
| longer exist.
|
| For example: Drive on the road, get to a toll, don't have a
| Transponder to pay the bill? No problem - just call a phone
| number. Uh, what if I don't have a cell? This literally never
| even occurred to them, there is no alternative way to pay the
| bill.
|
| That's life today, and it applies to children as well. Want
| to go to some sports place that only caters to teens and
| above? Load this website on your phone and fill out an
| application. Don't have a phone? Borrow a friends phone.
| Minor49er wrote:
| The toll roads I've seen on the east coast will just scan
| your license plate and mail you a bill if you don't have a
| transponder
| Broken_Hippo wrote:
| This is the common way in Norway. Have the toll thingy or
| get a bill.
| TedDoesntTalk wrote:
| They're given chrome books in school and can't complete
| assignments without them. Now what?
| jacquesm wrote:
| Brilliant insight. Could you please convince my children's
| school that they do not need a smartphone? Because they f'ing
| mandate it and I have not found a way around this yet.
| bigfudge wrote:
| Says someone who doesn't have kids. I really don't think it's
| a big empathetic leap to imagine that young teens would want
| to take part in the modern world, and that includes some
| access to the internet.
|
| And no, constant supervision is not an appropriate answer.
| Teens will want to research some things without their
| parents' knowledge. That's normal.
|
| But it doesn't mean that we should throw our hands in the air
| and make no effort to protect the majority of kids from the
| worst of the internet. Yes some bright sparks may find ways
| to circumvent the controls, but it at least makes it harder
| for them to send a disguised goatse link to their friends.
| tablespoon wrote:
| > Says someone who doesn't have kids. I really don't think
| it's a big empathetic leap to imagine that young teens
| would want to take part in the modern world, and that
| includes some access to the internet.
|
| At one point, "tak[ing] part in the modern world" included
| smoking, and lots of kids wanted to do it. Just saying.
| underwater wrote:
| This is such a naive take. I assume you don't have kids or
| teens?
|
| Children don't exist in a neat subservient bubble. They have
| peers, social pressures, see advertising, consume television
| and movies.
|
| Our kid's school had everyone buy an iPad. Already, at pre-
| phone age, so much socialisation has moved into the digital
| space. FaceTime, iMessage, Roblox, etc.
|
| I was going to say banning phones would be like a kid in the
| 80s without television. But really it would be like being a
| kid in the 80s who wasn't allowed to have a TV, listen to the
| radio, have a phone line, and wasn't allowed to socialise
| outside of school.
| sroussey wrote:
| Actually, TV was severely limited as were video games. We
| were told to go outside and not come back until it was
| getting dark.
| Fogest wrote:
| I have a browser based game I play that makes use of many
| userscripts and browser extensions to further improve/enhance
| the game. However mobile users suffer from a problem of not
| having such extras. There is a very nice app someone made on
| Android and iOS that uses in-app browsers in order to be able
| to add a lot of custom things.
|
| There are many useful instances for the in-app browsers and I
| don't think they should be removed because of some bad actors.
| It's similar to how Android has had password managers making
| use of autofill tools via accessibility tools. Android was
| butchering that access, but luckily started adding some
| official autofill support.
|
| I don't think removing capabilities in the favour of "safety"
| is usually the right approach in my opinion.
| RainaRelanah wrote:
| Mind if I ask what game?
|
| Kiwi on Android is a Chromium fork that re-enables extensions
| on mobile. Works well for userscripts/extensions, though
| often times those UIs don't scale well to mobile.
| aaaaaaaaaaab wrote:
| Ok guys, you've heard it, there's an app that uses in-app
| browser to let you play some browser-based game! I guess
| we'll just have to accept the status quo, otherwise the
| mobile players of this niche browser-based game would be
| inconvenienced!
| celtain wrote:
| Most of the usecases mentioned in this thread wouldn't suffer
| if the in-app browser had to be invoked with a whitelist of
| approved domains/urls. Perhaps apps could request permission
| to run an unrestricted in-app browser, and that could be used
| to facilitate parental controls.
|
| As an aside, is giving parents the option to disable in-app
| browsers removing a capability or adding one?
| Fogest wrote:
| Yes I think in app browsers should still follow parental
| controls, and I don't see why that wouldn't already be a
| thing on devices. If I can use a VPN on my phone and have
| that block sites for me, it seems like it should be pretty
| trivial for the phone to respect parental controls across
| all apps, not just specifically web browsers.
|
| That would be an additional capability. But having to force
| a website to give specific apps permission to display them
| in-app seems like a removal. Some people are also
| suggesting removing in-app browsers which also seems silly.
| franga2000 wrote:
| If someone is knowledgeable and committed enough to dig through
| all their apps, find any in-app browsers and try to break out
| onto the web, they will also realize that simply using another
| device will bypass all your silly blocks.
| wepple wrote:
| Tangential, but these same links have always been a great way
| to break out of poorly designed kiosk systems.
|
| I recall noodling with a huge interactive display on the side
| of a bus stop that had an embedded map, and surely enough the
| TOS link launched a browser, and from there you could use the
| Save As dialog to get to anything to execute
| sirsinsalot wrote:
| Novell Netware had a similar bug circa 1998 whereby pressing
| `F1` at the login screen of the terminal opened the help
| dialog, which opened links in IE ... from there the main
| Windows shell could be ran and bingo ... you're in.
| TedDoesntTalk wrote:
| I never saw IE or Windows running on Novell Netware. It was
| a server operating system. What you're saying is akin to
| saying you can create a windows shell from inside linux.
| brk wrote:
| The Netware backend server was it's own OS, IIRC. However
| on the client side, you had MS-DOS and Windows Netware
| clients to login to the Novell server and access the
| associated shared resources.
| TedDoesntTalk wrote:
| Right, but those clients weren't "Novell netware".
| yesbabyyes wrote:
| I think what they mean is the Netware login dialogue, on
| Windows. My classmate hacked our high school's network,
| getting him thrown out of class. I'm pretty sure he used
| a different method, though. He got a job working for the
| school. This was in the mid 90s.
| mandevil wrote:
| Colonial? (This definitely happened at my school,
| wondering how common this was.)
| bparsons wrote:
| This brought back many fond memories of using this hack to
| play Soldier of Fortune 2 on the school network.
| ghayes wrote:
| This is how I get to web videos on my Peloton. Viewing the
| mandatory software licenses leads to web links and then you
| can visit anything in that Chrome browser window.
| password4321 wrote:
| Risky share -- the statute of limitations is not up on that
| one!
| grishka wrote:
| Also on Android-based kiosks, you can get into the OS through
| the on-screen keyboard if they're using it. Try long tapping
| the buttons around the spacebar, one of them would usually
| get you into system settings. From there you can as much as
| completely take over the device if you wish.
| orlp wrote:
| As a kid I loved doing this in every museum/library/other
| place that always had 'locked down' interactive Windows
| systems back in my youth.
|
| One of my favorite ones was in a museum where I was with a
| friend, and there was a PC. We were bored and wanted to play
| some flash game, but we only had access to a mouse, and
| clicking links inside the locked fullscreen browser. With
| enough clicks we got to google and managed to copy/paste
| letter by letter the name of a game site in the search field
| and play some games.
| dbtc wrote:
| And I'm just excited to be able to 'visit' a museum from
| the internet :-)
| O__________O wrote:
| Reminds me of stories I have heard about users of computer
| systems with "strong" access controls figuring out ways to make
| it to unfiltered internet; examples include: student/prisoner
| computer labs, public libraries, flight entertainment systems,
| public kiosks, operating system logins, etc.
| amenghra wrote:
| In the early 1990s, we used to break out of Macintosh's AtEase
| at our middle school by writing a two line MacBasic program
| which launched Finder. We would then bring games on floppies.
| Everything old is new again!
| [deleted]
| nmeofthestate wrote:
| Of course. That's the point of in-app browsers right?
| sergiotapia wrote:
| Sick company. Period.
| [deleted]
| cdransf wrote:
| If you insist on running Meta's spyware on your devices you can
| also use a service like nextDNS to block trackers at the device
| DNS level: https://apple.nextdns.io
| nelblu wrote:
| I have always hated inapp browsers. I am a degoogled android
| user, and I despise any app that defaults browsing to inapp
| browser. If you are a developer who is defaulting to inapp
| browser, please stop doing it. (Biggest reason I hate inapp
| browsing is my ad-blocker and custom ublock origin scripts don't
| work correctly.)
| AlexandrB wrote:
| Awful stuff. I shudder to think what a Meta-run App Store or
| "metaverse" would look like from a tracking perspective.
| Meanwhile, the "dumb fucks" quote[1] remains evergreen.
|
| [1] https://www.businessinsider.com/well-these-new-zuckerberg-
| im...
| blueagle7 wrote:
| Does anyone know if something like Hyperweb would affect the
| tracking in this?
| kart23 wrote:
| surprised this is at the top of HN. isn't it obvious that every
| app does this? tiktok, snapchat, even linkedin all open links in
| their built-in browser and can track what you're doing. click
| open in safari if you're doing anything more than visiting a
| single page.
| SnowHill9902 wrote:
| It's not obvious but it is reasonable.
| joshstrange wrote:
| I was/am a little surprised since I thought everyone had to use
| SFSafariViewController for stuff like this (which doesn't allow
| the developer to reach in). I "eject" out to Safari almost
| always when I get in in-app-browser (if only for cookies/logged
| in status) so this doesn't affect me much but it did come as a
| surprise.
| InCityDreams wrote:
| >isn't it obvious that every app does this?
|
| Not if you never have/ don't use them.
| M4v3R wrote:
| Not every app does this. Twitter for example doesn't, because
| it uses SFSafariViewController which doesn't allow for script
| injecting.
| stevage wrote:
| As a non mobile developer, no, this was completely surprising
| to me.
| webercoder wrote:
| I naively assumed that they were using a WebView object and
| that Apple had tight controls over source code injection. Silly
| me!
| altairprime wrote:
| Apple has deprecated but not yet removed the legacy web
| embeds that app developers use to spy on and track their
| users.
| madeofpalk wrote:
| It's not surprising, but it's not obvious.
| MrStonedOne wrote:
| plif wrote:
| Yep, this is a feature, not just for tracking but also
| containment when navigating to external links. Big reason why
| all of those apps and others aggressively push users from web
| to mobile.
| somerando7 wrote:
| To me it's not obvious. I wouldn't think that an app can inject
| JS into a website because I'm using a web-browser from their
| app.
| sixothree wrote:
| Also why is the headline "Instagram _can_ track anything you do
| on any website in their in-app browser"?
| stjohnswarts wrote:
| isn't this true for all in-app browsers?
| kurupt213 wrote:
| Never go in app
| ma_arkus wrote:
| Meta (Facebook, Instagram, Whatsapp) is the sneakiest,
| impertinent and most evil company of all them all.
|
| Much worse than the tracking and spying is how Meta does
| everything to make people addicted to their slot-machine like
| services and thereby destroying their mental health. Especially
| harmful for kids.
|
| The world would be a much better place without it.
| benguild wrote:
| Obviously! That's the whole reason they don't just use the Safari
| modal
| spoonjim wrote:
| Every app that uses an in-app browser (which is most of them) can
| do this. This is a clickbait headline that relies on "Blue
| Company Bad" sentiments.
| mirkodrummer wrote:
| I'm not surprised and it's really annoying apps still use in-app
| browsers. I remember even Telegram had that at one point, with
| link opening only on in-app browser(at least on iOS). But what
| really annoys me is that most of the users, e.g. my girlfriend,
| have NO IDEA about the difference, it's just a browsing window,
| no matter in-app, which engine, with which privacy feature.
| Perhaps os vendors should show more obvious UI, and UX wise, tell
| you you're leaving a safe browsing experience?
| pphysch wrote:
| Isn't this the main reason why social media pushes their apps
| over their (once) perfectly functional websites?
|
| Better analytics = better product*.
|
| * for the true customers, i.e. marketing & communication firms,
| governments, etc.
| l33t2328 wrote:
| Why do you say "true customers"?
|
| Is anyone under the impression that they are a customer of a
| service they don't pay for?
|
| People would readily identify as a "Twitter user" instead of a
| "Twitter customer"
| happymellon wrote:
| I would agree that a lot of people who use these things do
| not consider themselves to be a product to be sold to
| marketing firms.
| woodruffw wrote:
| > Is anyone under the impression that they are a customer of
| a service they don't pay for?
|
| Maybe not on a technical forum like this, but I think the
| distinction between a "customer" and a "user" is sufficiently
| fuzzy among non-technical people.
| rightbyte wrote:
| E.g. Samsung spies on paying users of their TVs.
| JohnFen wrote:
| These days, you can expect companies to do the exact same
| thing even if you do pay for the service.
| scraplab wrote:
| As a provider is it possible to defend against this with a
| Content Security Policy or does this mechanism override the
| site's CSP?
| the_mitsuhiko wrote:
| External sources yes, preventing an app to inject inline HTML
| and JavaScript is tricky.
| ezekg wrote:
| You can block all inline scripts via CSP.
| the_mitsuhiko wrote:
| That's why I said tricky and not impossible.
| xfitm3 wrote:
| Strides have been made in web security, check out the
| permissions policy[0] along with COOP and COEP[1].
|
| [0] https://www.w3.org/TR/permissions-policy-1/ [1]
| https://scotthelme.co.uk/enabling-coop-and-coep-reports-on-r...
| robocat wrote:
| MDN docs for Content Security Policy:
| https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP (for
| anyone unfamiliar with that browser feature that should _in
| theory_ disallow injection for websites you control).
| eis wrote:
| They not only track very invasively what you are doing but they
| create real problems for websites because certain features wont
| work anymore. Be it due to them disabling them or third party
| services having to block their usage because of the huge privacy
| and data safety issue.
|
| Simple example: try to use "Login with Google" from within one of
| those in-app browsers and you will notice Google had to actively
| detect them and block the attempt because otherwise the app could
| spy on the login credentials without anyone noticing.
|
| Instagram, Twitter, Facebook Messenger, TikTok.... the list goes
| on and on.
|
| I am very confident that these companies are breaking GDPR laws
| left and right on an absolutely massive scale. They are spyware
| at this point.
| klabb3 wrote:
| I'm with you. If you're navigating to a website, you should
| open the web browser. The app shouldn't monitor or inject crap
| when I'm going to an unaffiliated site. The worst offenders are
| the ones that force you to enter credentials for a 3p account
| with an in-app browser.
|
| That said, it's a huge UX failure that navigating between the
| web and an app is so broken. That doesn't mean that it's
| motivated to break the fundamental models of the web. Long term
| it does much more harm than good. How do you teach non-
| technical users good practices if developers circumvent these
| barriers anyway? "Trust us, we won't steal your Google account"
| is not exactly reassuring, but ok say that you trust a
| reputable app to do that. What happens when the user normalizes
| this behavior and a less reputable app does the same thing?
| Obviously many users will have no idea of the risk.
| AtNightWeCode wrote:
| I believe this is not legal. It is a grey area for users to do
| things like this but for a browser to change the actual contents
| is illegal on most sites. Or at least, there is no general way
| for a browser to validate if it is legal or not.
| AtNightWeCode wrote:
| HN should really get rid of the down votes... Please explain
| why you think it is legal for a proxy to inject custom scripts.
| I am sure our TOS states that this is not allowed. Also, I
| think it basically is a copyright infringement.
| shadowgovt wrote:
| Interesting. This is a risk vector I never considered regarding
| allowing third parties to provide a browser on a mobile device.
| nemothekid wrote:
| I also noticed TikTok does this as well; at the very least they
| are snooping inside their in-app browser to prevent you from
| visiting adult sites.
| Flimm wrote:
| The article isn't complaining about in-app browsers per se, but
| that Instagram implements a special version of an in-app
| browser that injects Javascript code to track user behaviour.
| If you have noticed TikTok doing the same thing, please publish
| a blog post about it, and I expect it would get attention here
| on Hacker News, at least.
| zahma wrote:
| Any reason why Google Maps wouldn't* use the same in-app
| tracking?
|
| Edit: meant why Google wouldn't do this. I guess what I really
| mean, is what are the chances they don't do this?
| smitty1110 wrote:
| Yeah, tracking your behavior. If you searched for a bar, did
| you look at other bars? Parking? What other things did you look
| at? All of this could potentially be used for segmentation.
| rawling wrote:
| Yes, Google Maps probably tracks your usage of Google Maps. But
| when you click through to a location's website, it doesn't open
| that in a local webview and track how you use their website.
|
| Whether Chrome tracks how you use it...
| wonderbore wrote:
| Please tell every newspaper to publish this so Apple puts a stop
| to this. I have no idea why they allow this. All apps should use
| Safari unless they're a browser and this rated "18+"
| TaylorAlexander wrote:
| Well I like when browsing reddit that when I open links they
| are sandboxed. The in-app browser in that case has an easy
| button to open to get to my normal safari if I want to.
| wonderbore wrote:
| I'd much rather seen a system-wide "container" implementation
| a-la-Firefox instead. Safari is pretty good at this but not
| as good as Firefox. I really want my real-life accounts be
| segregated from the rest of the internet. Reddit should never
| be able to know what other sites I use.
| tiku wrote:
| I still remember the LinkedIn app ripping all my contacts, so no
| apps for me. I just use the sites.
| AtNightWeCode wrote:
| I remember when the Twitter app asked if I wanted to sync the
| mobile contacts every time I opened the app. Thankfully Android
| has become better when it comes to this even if there are still
| flaws.
| testfoobar wrote:
| Quite a few apps from the early mobile days did this.
| jimbob45 wrote:
| I just keep an old phone around for when I need to use apps
| (banking, especially). Can't steal the information off my
| device if there's nothing on there _taps forehead_
| PenguinCoder wrote:
| > use the sites.
|
| Which are increasingly user hostile, if not down right
| impossible to view on mobile. Go try using Reddit or Twitter on
| your Mobile browser.
| navbaker wrote:
| It is infuriating that I can't browse certain Reddit pages
| because they want me to "use the app so they know I'm over
| 18". I first ran into this in my current attempt to play
| through Dark Souls 3. It seems like the community there has a
| lot of good discussions about beating certain bosses, but for
| some reason, Reddit has decided that the content in that sub-
| reddit needs age verification and they wall it behind the
| app.
| thaumasiotes wrote:
| > It is infuriating that I can't browse certain Reddit
| pages because they want me to "use the app so they know I'm
| over 18".
|
| Nothing's stopping you. There is no such message on
| old.reddit.com.
| navbaker wrote:
| I had no idea this existed
| PenguinCoder wrote:
| Use it while you can. Can bet they'll disable it soon.
| winternett wrote:
| They also restrict your ability to copy links and text in
| apps, so that you can't open things in a non-walled app
| browser. This I believe is why sites like Twitter also uses
| URL conversion... There is a wild variety of ways in which
| they can limit where those URLs go, and I've noticed
| sometimes it even makes externally pointing links not work
| properly (Which can be turned on and off at will by the link
| service owner).
|
| Those URLs also mask origination when they point to other
| sites, so that site logs don't provide any real specific data
| on where traffic to them is coming from.
|
| The most Internet/user hostile era ever is probably going on
| right now. Will be interesting to see where this all goes.
| rmnclmnt wrote:
| My solution to this for past year: only use the laptop for
| most things. No more distractions in the pocket, feels pretty
| good!
| comprev wrote:
| Reddit, Twitter, Instagram, Facebook (and
| mbasic.facebook.com), LinkedIn, etc. are all user hostile.
|
| This gets amplified when using ad/tracker blockers at DNS
| level (NextDNS).
| kurupt213 wrote:
| That makes it real easy, actually. No Reddit or Twitter
| jeffwask wrote:
| RIF is a good alternative Reddit phone client.
|
| https://play.google.com/store/apps/details?id=com.andrewshu
| ....
|
| For those of us who can't go to the bathroom without
| reddit.
| corobo wrote:
| I used this to reduce my usage of the sites. It's so terrible
| I'm in and out in just enough time to check notifications
|
| Having said that I find Twitter to be quite usable in a
| mobile browser, it's one of the few that isn't awful
|
| Facebook is by far the worst, image posts overlap the edges
| of the screen, terrible for anything with text overlaying[1].
| You can use the mobile version instead but then you can't use
| FB messenger at all
|
| [1] e.g. https://img.imgy.org/-7p8.jpg
| prmoustache wrote:
| Actually twitter is fine on a mobile browser provided you use
| an account.
|
| What I miss is the multi-container extension on
| fennec/firefox mobile. I keep using those sites in incognito
| mode but that mean I can only use one at a time.
| PenguinCoder wrote:
| > provided you use an account.
|
| Within 3 days of registering a new account they will prompt
| you 'for a phone number, because we detected security
| issues with your usage'. Don't know how having a phone
| number helps with security issues like that, but again
| -user hostile-.
|
| I'm not creating a Twitter account just to read their
| public site, because they are user hostile and privacy
| invasive.
| macNchz wrote:
| I actually find Twitter's mobile web app experience to be
| pretty good-they don't nag me to install the app every 5
| seconds, it's reasonably performant, the back button works
| properly and even mostly preserves scroll position. All of
| the core functionality is there, except new features like
| Fleets I don't care about anyway. I use it regularly and have
| been pretty impressed.
|
| Reddit on the other hand is absolutely hostile and basically
| none of what I said above is true of their mobile web UI. I
| refuse to install their app simply out of spite for how
| aggressively they nag for me to use it. I've said no like 500
| times at this point, will I change my mind on the 501st
| prompt?
| dylan604 wrote:
| I all I ever see when following Twitter links on mobile is
| the lower 1/3 of the screen with a "it's better in the app"
| banner bullshit. What web app from Twitter are you seeing
| that doesn't have that?
| eCa wrote:
| I have the same experience. When I want to access twitter
| I use https://nitter.net/<twitterhandle>
| miramba wrote:
| Thank you!! I was unsuccessfully searching for something
| like this. Btw I also see a full screen, not closable
| login nag when scrolling down a few tweets. The solutions
| is to tap on login and close the dialog on the following
| screen. I won't make an account, twitter. Shut me out
| completely and I'll be gone, just like with reddit.
| rrix2 wrote:
| Its significantly less hostile if you use it as an web
| app, logged in. Even presents a PWA that is basically
| indistinguishable from the Twitter-Lite app served to
| data starved localities in Google Play.
| slickdork wrote:
| Have you tried using the website without logging in?
| Basically impossible.
| BudaDude wrote:
| I just saw this in another article:
| https://apps.apple.com/us/app/banish-for-safari/id1632848430
|
| I wonder if it can solve this problem since
| reddit/twitter/tiktok won't stop.
| [deleted]
| onlyrealcuzzo wrote:
| This theoretically can't happen anymore, right?
|
| You have to give apps permission to get your contacts, right?
| cloudking wrote:
| They can also track anything you do outside their browser, on a
| website with their tracking pixel.
| croes wrote:
| You can install blockers in your browser but not in in-app
| browsers
| stephenson wrote:
| This is why I have pi-hole on my network
| (https://github.com/pi-hole)
| hashishen wrote:
| Firefox has built in tracking protection to prevent this iirc
| ledauphin wrote:
| I can't imagine why anyone would expect otherwise. If you're
| still 'inside' an application, why wouldn't that app be able to
| track everything you do?
|
| To completely hijack the discussion here, I believe that Apple is
| actually one of the strongest forces for anti-privacy in the
| world, because of their long-term, successful push for the
| convention of app > website (not fully supporting PWAs,
| disallowing web push, etc). A website may spy on you, but it can
| only do so in ways constrained by the browser, which has to serve
| many "masters". Mobile apps are completely unconstrained in their
| spying, and in-app browsers are just the logical extension of
| that pattern.
|
| Thanks largely to Apple, we've conditioned ourselves to expecting
| that you can't have good mobile UX without a mobile-native
| application, and it's hard to imagine ever escaping back into the
| relatively open web now that we're this far down this path. Most
| people will never question the privacy implications of installing
| the Facebook app, and most of Apple's privacy-directed efforts on
| iOS are basically playing walled-garden whack-a-mole on problems
| that are better solved at a societal level with web browser
| standards.
|
| Yes, it's quite likely that I'm scapegoating here, but it's the
| way I see it.
| ezfe wrote:
| Apps that use Safari View Controller cannot view the page - of
| course Facebook doesn't use SVC for this reason.
|
| While you're right that the Facebook/Instagram app can spy on
| links opened within the app, it can't plant cookies in your web
| browser - so those go both ways.
| jefftk wrote:
| I thought Facebook/Instagram used a WebView for their in-app
| browser on both iOS and Android? Which means they can do
| anything they want, including exfiltrate your browsing.
| wonderbore wrote:
| GP a was referring to a specific "web view" implementation
| that offers an almost-complete browser implementation and
| security on iOS. Facebook does not use this but a regular
| WebView
| ezfe wrote:
| I meant "of course Facebook doesn't [use Safari View
| Controller]". WebView [?] Safari View Controller.
|
| Safari View Controller keeps the users cookies from Safari
| and prevents this behavior. For most apps, keeping users
| logged in without leaving the app is preferred, so they
| give up the ability to inspect the contents of the page.
| jefftk wrote:
| Sorry, rereading your comment that's exactly what you
| said and I just misread!
| saagarjha wrote:
| > Safari View Controller keeps the users cookies from
| Safari
|
| It does not, because apps decided to abuse it for
| fingerprinting.
| [deleted]
| iamjk wrote:
| Isn't this... what everyone (that uses in-app browsers) does? I
| just assumed that's a big reason _why_ one would use in-app over
| sending a person to their native environment, which is decidedly
| a better browsing experience.
| yreg wrote:
| I think that in times when user just quickly checks some
| website the better UX is to stay in the app, so there would be
| legitimate use cases.
|
| e.g. Apollo by iamthatis here on hn does this and I very much
| doubt he is doing it for tracking reasons.
| nxtbl wrote:
| Open in [X] Firefox Focus
|
| and it forgets everything when you close it.
| solarkraft wrote:
| No shit! Instagram tracks what I do in the Instagram app!
| eis wrote:
| You get a link inside Instagram to some website that does not
| belong to Instagram. It is none of Instagrams business what you
| do on that website. People do not even realise they are still
| inside Instagram while logging into their bank account and
| Instagram keeping a log of some of their activity inside that
| bank website. It's insane.
| elorant wrote:
| That's the definition of a malware.
| sneak wrote:
| If these platforms do things that are abusive and invasive, the
| solution is not to complain about it, the solution is to _stop
| donating content to them for free_ and _delete your account_ so
| they aren 't attractive to more users.
|
| Continuing to enrich them, even by your reachability via their DM
| messengers, makes them more attractive to your friends and
| family.
|
| Delete your Facebook and Instagram accounts. Stop giving them
| positive feedback (via continued usage and content donations)
| after they make clear choices to abuse you.
| dazbradbury wrote:
| Websites need cookie notices, but apps can track your full web
| usage (albeit within the in-app browser) without any such notice
| or opt in? Doesn't seem like this would be legal. Anyone know how
| this could be compliant in the EU?
|
| It's also frustrating that on an android device you can't simply
| disable in-app browsers globally.
| flipbrad wrote:
| The EU+UK e-privacy "cookie" rule applies to apps in the same
| way as anything else that's sending/receiving data over a
| public network (e.g. the Internet): all storage of information
| to, or reading of information from, the end-user device
| requires their free, informed and specific consent, unless it's
| a technical necessity for the service they requested, or
| certain limited (technical) purposes like load balancing. How
| strictly this is enforced by regulators has waxed and waned
| over time and from one country to another. Civil litigants,
| however, have had pretty good results in the courts (or just
| threatening litigation) - e.g. the Lloyd and Vidal-Hall cases
| against Google in the UK
| fleddr wrote:
| I'm not familiar with the Instagram signup flow but it may very
| well be that the user did opt-in at one point. The opt-in would
| of course only be valid if there's also a clear "reject"
| option.
| karek wrote:
| Why is this legal?
| georgex7 wrote:
| Another reason why we hate Zuck:
| https://backtohumanity.substack.com/p/why-people-hate-zuck
| nodejsthrowaway wrote:
| Is this different from my android experience where I open a link
| from an app and it opens my default browser, Firefox, but kind-of
| within the app, but allows me to instantly switch over to the
| Firefox app instead using a drop-down menu option?
| Flimm wrote:
| iOS provides a way of showing a browser that looks like it's
| within the app from which it is launched. This is not what
| Instagram is doing. Instagram is doing something different from
| what other apps like Telegram do, according to the article:
|
| > Comparing this to what happens when using a normal browser,
| or in this case, Telegram, which uses the recommended
| SFSafariViewController:
|
| > As you can see, a regular browser, or SFSafariViewController
| doesn't run any JS code. SFSafariViewController is a great way
| for app developers to show third party web content to the user,
| without them leaving your app, while still preserving the
| privacy and comfort for the user.
| izacus wrote:
| Android has two ways of doing that - Chrome Custom Tabs which
| are secured against this (iirc) and WebView which isnt.
|
| Custom Tabs always have a title bar and a small writing
| "Powered by <browser>" at the end of the menu.
| dilDDoS wrote:
| I generally don't see any appeal to in-app browsers in the first
| place. They often have extremely broken navigation controls (i.e.
| attempting to swipe back to a previous page usually just returns
| back to the app), block the ability to navigate to a specific
| URL, content blockers don't work, don't allow opening "smart
| links" that would typically open in another app if opened from a
| normal browser, etc. From what I'm gathering from this article,
| it sounds like in-app browsing allows apps to give you all of the
| "benefits" of being tracked (for their benefit only), with none
| of the (actual) benefits of using a real browser.
| inlined wrote:
| The appeal of in-app browsers is that apps like Facebook can
| boost their "time in app" metrics while you read linked
| articles.
| the_gipsy wrote:
| They lock users into the app. Every app and website tries hard
| to not let the user follow a link. Engagement.
| darth_avocado wrote:
| I frankly am surprised why anyone would think otherwise? The
| "In-app" in the name should kind of give it away that it is,
| after all, in the app. Anything you do will be available for
| the app to track.
| lrvick wrote:
| Consider the overwhelming majority of users are technically
| illiterate. Everything is just magic scrolling machines
| people learned to trust from watching people they trust use
| them.
| darth_avocado wrote:
| I would sympathize with all of the illiterate users. But
| the person who reported this and the people on HN
| discussing the article would be considered a little more
| technologically literate I would assume.
| rchaud wrote:
| Considering that a simple iOS privacy disclosure dialog box
| cost FB $10bn in revenue loss, I'd say there are a lot of
| things users would be surprised to know when it comes to how
| apps work and what they collect.
| zippergz wrote:
| I'm sure this has gotten better as people have become more used
| to smartphones, but I worked on a popular app for a big company
| a number of years ago, and we would send people out to Safari
| to open links. The number of customer service calls we got from
| people who couldn't figure out how to get back to the app after
| that was ASTOUNDING. We eventually gave in and did an in-app
| browser. Not only did it get rid of that category of call, but
| it also noticeably helped our key metrics because fewer people
| were leaving the app to never come back again.
|
| I realize that doesn't address the appeal FOR USERS, but it is
| why we did it as developers.
| fleddr wrote:
| Same issue when your website opens a link in a new tab on
| mobile: many mobile users have no idea how to get back. The
| back button does not work and they don't know how to
| close/switch tabs. They're barely aware of the concept of a
| tab.
| autoexec wrote:
| > They're barely aware of the concept of a tab.
|
| What mobile browsers actually have tabs that look like
| tabs? Honest question, I've only ever used firefox on
| android. If the others handle tabs anything like firefox
| does tabs are way more intuitive on a PC.
| fleddr wrote:
| None, and that's indeed the issue. You can't even see
| you're in a tab as the entire concept is in no way
| communicated.
| djxfade wrote:
| iOS does have visible tabs, identical to desktop Safari.
| But only in landscape mode
| brianslp wrote:
| This has actually been fixed since iOS 9: https://developer.a
| pple.com/documentation/safariservices/sfs...
|
| This opens Safari, but makes it _appear_ like it 's an in-app
| browser. Best of both.
| [deleted]
| mtlmtlmtlmtl wrote:
| That's a very understandable decision from an app developer
| POV. But the fault lies with the OS and ideally should be
| solved by it. This isn't a problem on real computers.
|
| It's like putting a toilet in every room because people can't
| find the bathroom when maybe the bathroom shouldn't have been
| hidden down in a hatch under a rug. But you can't easily
| rebuild your house, and now there's shit everywhere, so what
| is one to do?
| judge2020 wrote:
| iOS 'solved' this by including a back button in the top
| left that takes you to the previous app, but now I
| sometimes misclick that when trying to hit a button/control
| in the top left of the foreground app. On a small 5 to
| 8-inch display, there's tradeoffs for every change they
| make and in every stage of the design process.
| thrashh wrote:
| I'm a developer and I remember turning off in-app browsers
| whenever I could and I absolutely hated it
|
| My browser would get littered with old tabs and coming back
| to the app for a small click became a hassle
|
| On the off-chance I do want to save a link, I know I can just
| open it in my browser anyway
|
| So I much prefer in-app browsers as a user and a developer
| conductr wrote:
| I feel like half the time I encounter them is when I'm
| already in my browser, click a link (probably search
| results), it opens the app, the app proceeds to display
| content in an in app browser.. and I'm just left think why,
| WhY, WHY?
| modeless wrote:
| I'm the opposite, I hate in app browsers as a user. It's
| like having a bunch of extra poorly made web browsers that
| can only have one tab, and block me from using one of my
| apps. When I'm trying to find a tab I had open now I have
| to search both my browser tabs and every app in my app
| switcher. And if I want to keep using an app but it's
| showing an in-app browser I have to either throw away my
| tab, or navigate a menu to migrate it to my real browser to
| save for later, then switch back to the app and close the
| in app browser, and only then can I continue to use the
| app. It's a constant pain.
| shawnz wrote:
| I think Android's "custom tabs" functionality is a great
| compromise. Apps can open a separate instance of the user's
| default browser which becomes part of the app's activity
| stack and doesn't share tabs with the main browser
| instance. However the UI and navigation are controlled by
| the browser, not the app. Cookies and local storage are
| also shared with the main browser instance, allowing
| seamless SSO without the app being able to intercept the
| secrets.
|
| AFAIK iOS supports something similar, but only for
| authentication use cases.
| brianslp wrote:
| iOS has essentially the same: https://developer.apple.com
| /documentation/safariservices/sfs...
| samtheprogram wrote:
| Ironically the whole point of it originally was sandboxing, and
| it's true at least on iOS. Thus, you won't be logged into the
| same sites within an in-app browser, and clicking a link from
| within an app (whether it appears to be an link or not) can't
| automatically connect you to cookies and any other tracking
| from your actual browser.
| tjoff wrote:
| On android I have firefox-focus as my default browser (and
| disable any in-app browsing) for that same purpose.
| flanbiscuit wrote:
| Also available in Firefox for Android (not just FF Focus)
|
| Settings > Advanced > "Open links in apps"
|
| https://support.mozilla.org/en-US/kb/set-firefox-android-
| ope...
| tjoff wrote:
| The point with firefox focus is that the whole browser is
| in private mode. And even another browser, so no shared
| sessions or anything with your normal browser or precious
| interactions/sessions.
|
| Not sure if open-links-in-apps is comparable to that,
| never tried it (I rather prefer multitasking than doing
| it from within the app anyway).
| mrtksn wrote:
| On iOS this is traditionally done with UIWebView or
| WKWebView(like the former but better performance, runs as
| separate process) and you are right about the problems it
| creates.
|
| However, the developers do have options to incorporate
| SFSafariViewController since iOS9.0 and that gives the user
| full Safari experience with Autofill and everything and without
| giving access to its contents to the app developer.
|
| It actually makes a lot of sense from users perspective when
| the context is that the app temporary needs to take you to a
| webpage for something with the intention of you going back to
| the app. With SFSafariViewController this is done securely and
| with good user experience but unfortunately most apps business
| model revolves around tracking everything you do and as a
| result, most developers would use UIWebView/WKWebView instead
| of SFSafariViewController just to be able to track you.
|
| The UIWebView/WKWebView has legitimate uses like letting you
| sign in from a web interface and transfer the session into the
| app but I kind of feel like we would be better off to
| depreciate it in favour of using alternative methods to do the
| web/app connection and improve privacy significantly.
|
| Personally, I would never do anything sensitive from within a
| browser that is in an app. It looks like very obvious attack
| vector to me.
| zionic wrote:
| > i.e. attempting to swipe back to a previous page usually just
| returns back to the app
|
| Is there any way to turn that damn functionality off? I can't
| tell you how many times I've been navigating some newfangled
| web UI and had a swipe go "back".
|
| That and disabling pinch to zoom backing out to the tabs UI. I
| wanna zoom out dammit. Is hitting a back or tab button really
| so hard that you have to break basic pan/zoom mechanics?!
|
| I know I'm putting off "old man yells at cloud" vibes here, but
| come on
| tolmasky wrote:
| It's even worse than that:
|
| 1. Nothing you visit gets saved in your history. So many times
| I'm looking through my history thinking "I could have sworn I
| read an article about this..." only to eventually discover (if
| I'm lucky) that it was in Twitter's stupid in-app browser. But
| oh well, never going to find that article again! The irony of
| the APP knowing everything you visit but you _never_ getting to
| remember what you visited.
|
| 2. All your logins are gone! I actually pay a bunch of stupid
| newspapers just to click on links in Twitter and STILL be told
| I can't read the article because of course I'm not logged-in in
| the in-app browser. UGH.
|
| You could imagine a world where iOS tried to balance the desire
| of an app to not bounce you out with a more "integrated
| experience" by providing an "in-app" browser that was
| completely controlled by the OS, modifying your history,
| keeping you logged in, running out of process, and being able
| to be "adopted" as a tab in Safari, but instead they just made
| "SFSafariViewController" which does none of these things and
| instead just makes it really really easy for all apps to
| incorporate these infuriating in-app browsers.
| dwighttk wrote:
| You might consider using Twitter in Safari instead of the app
| based on those irritations.
| tolmasky wrote:
| On everything other than iOS (desktop and iPad), I either
| use Twitter in the browser or it is reasonable to just have
| links open in the main browser. Using Twitter in Safari on
| iOS (on the phone, to distinguish it from iPadOS), you end
| up with kind of the reverse problem of needing to fish
| around for Twitter in tabs. If Safari on iOS had a better
| "save web app"/site-specific browser story, then this could
| possibly remedy some of these problems (or if they
| implemented some of the basic ideas I described, like
| storing history).
| kccqzy wrote:
| The original SFSafariViewController did share cookies with
| regular Safari. The documentation says
|
| > In iOS 9 and 10, it shares cookies and other website data
| with Safari.
|
| I was also also disappointed that they removed it in iOS 11.
| But it's still a step-up from other even more horrible in-app
| browsers like in Instagram, which are implemented with
| WKWebView. I refuse to read anything in those in-app
| browsers; I always manually open them in Safari.
| nocsi wrote:
| lol what you're describing as a 'feature' is actually
| insecure & vulnerable. There are strong security reasons
| why Apple mandates WKWebView and bans SFSafari.
| 0x0 wrote:
| What are you talking about? Care to give some sources for
| this?
| djxfade wrote:
| Not really, SFSafariViewController was a "view" only
| controller. The app couldn't communicate or extract data
| from it.
| mrtksn wrote:
| > instead they just made "SFSafariViewController" which does
| none of these things
|
| Actually, SFSafariViewController acts as a full Safari
| without giving any ability to the developer to inject scripts
| or receive data to track you(except for ad taps through
| Private Click Measurement). It's actually a nice solution, it
| shares cookies(non-session ones) with Safari.
| tolmasky wrote:
| Right... by "none of these things" I meant... the stuff I
| listed, which for the record is not incompatible with
| isolating the browser from the initiating app. It would be
| totally viable to give SFSafariViewControllers "write only"
| access to your history (implemented as just an API call
| that SFSafariViewControllers makes to notify the OS of a
| page navigation, which it can then store the URL of in your
| history, so that when you go to history in Safari later, it
| would show up there). Similarly, there could be a very nice
| "adopt as tab" button that would "rip" the view controller
| out of the enclosing app and just plop it into Safari
| proper, complete with it's back-forward list/history, and
| make it really easy to transition from the app to Safari
| without the much less ideal "open in Safari" button that
| loses navigation/page-state/etc. In other words, the way
| SFSafariViewController could work is that you _are_ in
| Safari (forcing the full screen experience), just with a
| "Done" button that takes you "back" to the app (or an adopt
| button that "solidifies" the app switch. Think something
| more akin to the "app banner" that Safari shows when you go
| to an app's page, just with a nice transition of the
| webpage coming in from the app, kind of like the old Mail
| animation from iOS 1). This actually accommodates both
| goals: you get the _real_ "full Safari" (again, you have
| effectively opened the link in Safari), but a nice little
| "Done" button to let you get back to what you were doing in
| the initiating app, which is the only "good faith" thing
| the app should care about (obviously we don't care about
| accommodating tracking/etc.).
| mrtksn wrote:
| I like the "adopt as tab" button idea a lot and generally
| agree but I also see the associated risks with other
| suggestions.
|
| For example, write only access to history will also mean
| SEO-consultant-type people paying app developers to write
| certain websites to the users history. When Safari does
| suggestions on the address bar, browsing history is a
| major source.
| tolmasky wrote:
| The only caller of said API would be the
| SFSafariViewController itself, the same way the Share
| Panel can see your Contacts despite you not having given
| the app that opened the Share Panel Contacts "access".
| This way, only organic page navigations get recorded (or
| at minimum is equally susceptible to any history
| pollution as a normal web page that you encounter). The
| idea was not to have SFSafariAddURLToHistory(), apologies
| if that's the way it came off.
| saagarjha wrote:
| Twitter uses SFSafariViewController, which does not give
| Twitter access to what you browse.
| tolmasky wrote:
| Right, I know. I mentioned SFSafariViewController in my
| post. I am saying, in the _9 years since
| SFSafariViewController was introduced_ , Apple could have
| made the experience with SFSafariViewController better, for
| example by having pages you visit in a
| SFSafariViewController get saved into your normal browsing
| history (this can be done without giving Twitter access to
| anything, it can simply notify the OS of an internal
| navigation, and then the OS can add that item to your
| Safari history. If SFSafariViewController runs out-of-
| process, then it can be even simpler than that). I then
| wouldn't have to keep a weird mapping in my head of what
| "app" I read an article in to ever get back to it. This
| would go a long way in closing the gap with the benefits
| you get from opening a link in Safari proper instead of
| viewing it in-app.
| sayrer wrote:
| Well, I'm sure there are "growth hacker" types out there
| abusing the ability to observe browsing. But I think the real
| reason they don't bounce you to Safari, Chrome, etc is because
| users don't stay in the app if they do that.
|
| I think all of the various bad things people talk about here
| must happen sometimes, but it's mostly just retention I'd
| guess.
| stingrae wrote:
| My assumption is that it is a Product managers play to get
| people to stay in the app for longer. If you give people a link
| out of the app, then they are less likely to come back after.
|
| You get a bump in engagement and time spent in the app at the
| cost of UX.
| nerdponx wrote:
| There is no appeal for users and there never has been.
| systemvoltage wrote:
| Instagram isn't doing it for the benefit of the user.
| rconti wrote:
| The very first thing I do, every time, is click "open in
| browser", just because, if nothing else, the framing of the
| site always feels "off" to me when using one of those in-app
| browsers.
| guelo wrote:
| Apps in general are awful for users. I do all my mobile social
| media browsing on the web where I have much more control over
| things like copying text, saving images, zooming, adblockers,
| privacy tools, etc.
___________________________________________________________________
(page generated 2022-08-10 23:00 UTC)