One thing I've noticed is that content-blockers/adblock don't seem to work within the Facebook/Instagram etc. in-app browsers so I usually end up jumping out of them anyway.
Yup same. I jump out as soon as it attempts to load and I have the ability.
Instagram can track anything you do on any website in their in-app browser
91–100 of 469 posts
Re: Instagram can track anything you do on any website in their in-app browser
#92Is this different from my android experience where I open a link from an app and it opens my default browser, Firefox, but kind-of within the app, but allows me to instantly switch over to the Firefox app instead using a drop-down menu option?
iOS provides a way of showing a browser that looks like it's within the app from which it is launched. This is not what Instagram is doing. Instagram is doing something different from what other apps like Telegram do, according to the article:
> Comparing this to what happens when using a normal browser, or in this case, Telegram, which uses the recommended SFSafariViewController:
> As you can see, a regular browser, or SFSafariViewController doesn’t run any JS code. SFSafariViewController is a great way for app developers to show third party web content to the user, without them leaving your app, while still preserving the privacy and comfort for the user.
Re: Instagram can track anything you do on any website in their in-app browser
#93>I’ve disclosed this issue with Meta through their Bug Bounty Program lol. and this is why companies can be hesitant to run bug bounty programs. it's not a place to complain about things you don't like. Meta/instagram has made a design decision here. just because you don't like it, doesn't mean it's a vulnerability.
Remember this is the same company that just gave police DMs that aided in an abortion investigation. If those had been end to end encrypted that risk would not have existed, but they made a business decision to leave the application vulnerable to spying for profit reasons. That is a vulnerability, in the same way we call it a vulnerability when an entity man-in-the-middles a browser to spy on people.
Personal user browsing or communications leaking in plain text to private companies without explicit and obvious user consent puts users at risk, and is a vulnerability. It just so happens to be one arising from malicious profit seeking behavior that happens to be the status quo.
Not having https was once the status quo, and a boon for corporate spying, but we call that a vulnerability now because the abuses became too big too ignore.
Re: Instagram can track anything you do on any website in their in-app browser
#94I generally don't see any appeal to in-app browsers in the first place. They often have extremely broken navigation controls (i.e. attempting to swipe back to a previous page usually just returns back to the app), block the ability to navigate to a specific URL, content blockers don't work, don't allow opening "smart links" that would typically open in another app if opened from a normal browser, etc. From what I'm g…
I frankly am surprised why anyone would think otherwise? The “In-app” in the name should kind of give it away that it is, after all, in the app. Anything you do will be available for the app to track.
Re: Instagram can track anything you do on any website in their in-app browser
#95i don't understand why apple allows in-app browsers.
Do you want to cripple the entire app industry? Apps built using React Nativ / Flutter e.t.c use the WebView to render themselves. So they’re basically already running “in-app browsers” But then how do you differentiate when the app is rendering its own view rather than another website? You could apply some restrictions like has nowadays where you need extra security privileges (I think) to render pages / execute scr…
It's a big difference between browsing your own pages in-app, and opening any link in an in-app browser and tracking it.
Re: Instagram can track anything you do on any website in their in-app browser
#96I also noticed TikTok does this as well; at the very least they are snooping inside their in-app browser to prevent you from visiting adult sites.
The article isn't complaining about in-app browsers per se, but that Instagram implements a special version of an in-app browser that injects Javascript code to track user behaviour. If you have noticed TikTok doing the same thing, please publish a blog post about it, and I expect it would get attention here on Hacker News, at least.
Re: Instagram can track anything you do on any website in their in-app browser
#97I generally don't see any appeal to in-app browsers in the first place. They often have extremely broken navigation controls (i.e. attempting to swipe back to a previous page usually just returns back to the app), block the ability to navigate to a specific URL, content blockers don't work, don't allow opening "smart links" that would typically open in another app if opened from a normal browser, etc. From what I'm g…
On iOS this is traditionally done with UIWebView or WKWebView(like the former but better performance, runs as separate process) and you are right about the problems it creates.
However, the developers do have options to incorporate SFSafariViewController since iOS9.0 and that gives the user full Safari experience with Autofill and everything and without giving access to its contents to the app developer.
It actually makes a lot of sense from users perspective when the context is that the app temporary needs to take you to a webpage for something with the intention of you going back to the app. With SFSafariViewController this is done securely and with good user experience but unfortunately most apps business model revolves around tracking everything you do and as a result, most developers would use UIWebView/WKWebView instead of SFSafariViewController just to be able to track you.
The UIWebView/WKWebView has legitimate uses like letting you sign in from a web interface and transfer the session into the app but I kind of feel like we would be better off to depreciate it in favour of using alternative methods to do the web/app connection and improve privacy significantly.
Personally, I would never do anything sensitive from within a browser that is in an app. It looks like very obvious attack vector to me.
Re: Instagram can track anything you do on any website in their in-app browser
#98>I’ve disclosed this issue with Meta through their Bug Bounty Program lol. and this is why companies can be hesitant to run bug bounty programs. it's not a place to complain about things you don't like. Meta/instagram has made a design decision here. just because you don't like it, doesn't mean it's a vulnerability.
Remember this is the same company that just gave police DMs that aided in an abortion investigation. If those had been end to end encrypted that risk would not have existed, but they made a business decision to leave the application vulnerable to spying for profit reasons. That is a vulnerability, in the same way we call it a vulnerability when an entity man-in-the-middles a browser to spy on people. Personal user br…
Yes, but people love that, otherwise e.g. freemium and ad-driven games would not exist.
Consumers have a payment-avoiding behaviour as a status quo.
Re: Instagram can track anything you do on any website in their in-app browser
#99I hope Apple doesn't disable JS injection in WKWebViews in response to this. JS injection is the (only?) way to call native Swift methods from JS ie. bridging. I am not sure what the solution here is. Maybe only allow injection to sites you control (via apple association file).
Wait, websites can call native Swift methods from JS?
Re: Instagram can track anything you do on any website in their in-app browser
#100Earlier quoted context omitted.
I all I ever see when following Twitter links on mobile is the lower 1/3 of the screen with a "it's better in the app" banner bullshit. What web app from Twitter are you seeing that doesn't have that?
I have the same experience. When I want to access twitter I use " rel="nofollow">https://nitter.net/
Thank you!! I was unsuccessfully searching for something like this.
Btw I also see a full screen, not closable login nag when scrolling down a few tweets. The solutions is to tap on login and close the dialog on the following screen.
I won‘t make an account, twitter. Shut me out completely and I‘ll be gone, just like with reddit.