Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram can track anything you do on any website in their in-app browser

krausefx.com

Post reply on HN
Print view View original

71–80 of 469 posts

Re: Instagram can track anything you do on any website in their in-app browser

#71

Post by pantulis »

ffpip wrote: post #6
senttoschool wrote: post #2

No wonder. I recently opened a link on Instagram and the website's responsive elements were completely broken. Then I opened the link in Safari and it worked fine. Does this script injection break Apple's ToS? I thought Apple required Safari/Webkit for all in-app browsers? Zuckerberg has no shame. PS. I hate in-app browsers. They don't sync with my main browser states such as authenticated sessions.

> Does this break Apple's ToS? I thought Apple required Safari/Webkit for all in-app browsers? They are still using Safari/Webkit, but just injecting a script into every page.

Is there a legitimate use case that could explain why Apple is allowing this?

Re: Instagram can track anything you do on any website in their in-app browser

#72

Post by winternett »

PenguinCoder wrote: post #21
tiku wrote: post #10

I still remember the LinkedIn app ripping all my contacts, so no apps for me. I just use the sites.

> use the sites. Which are increasingly user hostile, if not down right impossible to view on mobile. Go try using Reddit or Twitter on your Mobile browser.

They also restrict your ability to copy links and text in apps, so that you can't open things in a non-walled app browser. This I believe is why sites like Twitter also uses URL conversion... There is a wild variety of ways in which they can limit where those URLs go, and I've noticed sometimes it even makes externally pointing links not work properly (Which can be turned on and off at will by the link service owner).

Those URLs also mask origination when they point to other sites, so that site logs don't provide any real specific data on where traffic to them is coming from.

The most Internet/user hostile era ever is probably going on right now. Will be interesting to see where this all goes.

Re: Instagram can track anything you do on any website in their in-app browser

#73

Post by jefftk »

ezfe wrote: post #44
ledauphin wrote: post #38

I can't imagine why anyone would expect otherwise. If you're still 'inside' an application, why wouldn't that app be able to track everything you do? To completely hijack the discussion here, I believe that Apple is actually one of the strongest forces for anti-privacy in the world, because of their long-term, successful push for the convention of app > website (not fully supporting PWAs, disallowing web push, etc).…

Apps that use Safari View Controller cannot view the page - of course Facebook doesn't use SVC for this reason. While you're right that the Facebook/Instagram app can spy on links opened within the app, it can't plant cookies in your web browser - so those go both ways.

I thought Facebook/Instagram used a WebView for their in-app browser on both iOS and Android? Which means they can do anything they want, including exfiltrate your browsing.

Re: Instagram can track anything you do on any website in their in-app browser

#74

Post by Mordisquitos »

EGreg wrote: post #55

I once wrote an email to Steve Jobs, saying that operating systems like MacOS and iOS should have a secret phrase or icon that they show to you whenever they show a system-level security dialog. (And of course implement the same restrictions on screenshots of that dialog as they do for movies.) Because otherwise, an app can totally fake the interface of a security dialog. The only way you know, these days, is that pa…

Fun fact, the Spanish word for password, "contraseña", originally implied this behaviour as "seña" —> "contraseña" ("sign" —> "countersign").

Re: Instagram can track anything you do on any website in their in-app browser

#75

Post by slickdork »

macNchz wrote: post #42
PenguinCoder wrote: post #21

Earlier quoted context omitted.

> use the sites. Which are increasingly user hostile, if not down right impossible to view on mobile. Go try using Reddit or Twitter on your Mobile browser.

I actually find Twitter’s mobile web app experience to be pretty good–they don’t nag me to install the app every 5 seconds, it’s reasonably performant, the back button works properly and even mostly preserves scroll position. All of the core functionality is there, except new features like Fleets I don’t care about anyway. I use it regularly and have been pretty impressed. Reddit on the other hand is absolutely hosti…

Have you tried using the website without logging in? Basically impossible.

Re: Instagram can track anything you do on any website in their in-app browser

#76

Post by sneak »

senttoschool wrote: post #20
samstave wrote: post #14

Earlier quoted context omitted.

> They don't sync with my main browser states such as authenticated sessions. Under what circums do you want this?

> Under what circums do you want this? Click on "Sign In/Up with Google". Opens in app browser. Not logged in even though I'm with Safari. Type email. Type password. Get password wrong. Type password again. Get text/email with 2FA code. Every single time. Or Gmail app. Click link. Open in-app browser. Not logged in.

You shouldn't be typing passwords in 2022, get a password manager.

Re: Instagram can track anything you do on any website in their in-app browser

#79

Post by AtNightWeCode »

I believe this is not legal. It is a grey area for users to do things like this but for a browser to change the actual contents is illegal on most sites. Or at least, there is no general way for a browser to validate if it is legal or not.

Re: Instagram can track anything you do on any website in their in-app browser

#80

Post by throwaway290 »

asadlionpk wrote: post #58

I hope Apple doesn't disable JS injection in WKWebViews in response to this. JS injection is the (only?) way to call native Swift methods from JS ie. bridging. I am not sure what the solution here is. Maybe only allow injection to sites you control (via apple association file).

Wait, websites can call native Swift methods from JS?
Post reply on HN