Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram can track anything you do on any website in their in-app browser

krausefx.com

Post reply on HN
Print view View original

101–110 of 469 posts

Re: Instagram can track anything you do on any website in their in-app browser

#101

Post by flanbiscuit »

tjoff wrote: post #83
samtheprogram wrote: post #61

Earlier quoted context omitted.

Ironically the whole point of it originally was sandboxing, and it’s true at least on iOS. Thus, you won’t be logged into the same sites within an in-app browser, and clicking a link from within an app (whether it appears to be an link or not) can’t automatically connect you to cookies and any other tracking from your actual browser.

On android I have firefox-focus as my default browser (and disable any in-app browsing) for that same purpose.

Also available in Firefox for Android (not just FF Focus)

Settings > Advanced > "Open links in apps"

https://support.mozilla.org/en-US/kb/set-firefox-android-ope...

Re: Instagram can track anything you do on any website in their in-app browser

#103

Post by kart23 »

surprised this is at the top of HN. isn’t it obvious that every app does this? tiktok, snapchat, even linkedin all open links in their built-in browser and can track what you’re doing. click open in safari if you’re doing anything more than visiting a single page.

Re: Instagram can track anything you do on any website in their in-app browser

#104

Post by dylan604 »

replygirl wrote: post #70
dylan604 wrote: post #60

Earlier quoted context omitted.

And yet, we're normally seeing Apple === BAD because they limit everything to just the one Apple thing. Am I actually seeing requests for Apple to limit willingly?

in 2015 i got an iphone for a job, then i made it my daily driver because i liked the restrictions. now my phones last four years instead of one

How is the walled garden allowing a phone to last for four years? Where you getting new phones because you polluted your non-walled garden device with so many bad apps that you chose to get a new device? Not really following your point, but maybe I am?

Re: Instagram can track anything you do on any website in their in-app browser

#105

Post by AtNightWeCode »

asadlionpk wrote: post #58

I hope Apple doesn't disable JS injection in WKWebViews in response to this. JS injection is the (only?) way to call native Swift methods from JS ie. bridging. I am not sure what the solution here is. Maybe only allow injection to sites you control (via apple association file).

Should only be allowed on domains one owns. Could be solved by DNS records or certificates.

Re: Instagram can track anything you do on any website in their in-app browser

#106

Post by _rend »

throwaway290 wrote: post #80
asadlionpk wrote: post #58

I hope Apple doesn't disable JS injection in WKWebViews in response to this. JS injection is the (only?) way to call native Swift methods from JS ie. bridging. I am not sure what the solution here is. Maybe only allow injection to sites you control (via apple association file).

Wait, websites can call native Swift methods from JS?

Only intentionally, via setup from a hosting app. If an app uses a WKWebView to display web content, it can use WKUserContentController[1] to inject scripts and additional content into the page dynamically, and can inject functions into JS[2] which will trigger native callback handlers when called.

If your app uses the JavaScriptCore[3] framework to run JS in a VM in-process directly, you have even more options for interfacing between JS and native code.

Note that this has to be explicitly hooked up by the app (i.e., none of this applies within, say, Safari).

[1]: https://developer.apple.com/documentation/webkit/wkuserconte...

[2]: https://developer.apple.com/documentation/webkit/wkuserconte...

[3]: https://developer.apple.com/documentation/javascriptcore

Re: Instagram can track anything you do on any website in their in-app browser

#107

Post by wmeredith »

lrvick wrote: post #93
notatoad wrote: post #65

>I’ve disclosed this issue with Meta through their Bug Bounty Program lol. and this is why companies can be hesitant to run bug bounty programs. it's not a place to complain about things you don't like. Meta/instagram has made a design decision here. just because you don't like it, doesn't mean it's a vulnerability.

Remember this is the same company that just gave police DMs that aided in an abortion investigation. If those had been end to end encrypted that risk would not have existed, but they made a business decision to leave the application vulnerable to spying for profit reasons. That is a vulnerability, in the same way we call it a vulnerability when an entity man-in-the-middles a browser to spy on people. Personal user br…

> this is the same company that just gave police DMs that aided in an abortion investigation

They were served a warrant. I'm no friend of Facebook/Meta, but any company served a warrant is going to turn over what they have.

Re: Instagram can track anything you do on any website in their in-app browser

#108

Post by Spivak »

throwaway290 wrote: post #80
asadlionpk wrote: post #58

I hope Apple doesn't disable JS injection in WKWebViews in response to this. JS injection is the (only?) way to call native Swift methods from JS ie. bridging. I am not sure what the solution here is. Maybe only allow injection to sites you control (via apple association file).

Wait, websites can call native Swift methods from JS?

Short answer: yes

With the appropriate libraries you can use JS to call Swift and Obj C code.

Long answer: no

All it really means is that the JS and Swift/Obj C can pass data between each other and the library is set up to parse that data and call the appropriate code. It's just an automatic RPC.

Re: Instagram can track anything you do on any website in their in-app browser

#109

Post by vade »

notatoad wrote: post #65

>I’ve disclosed this issue with Meta through their Bug Bounty Program lol. and this is why companies can be hesitant to run bug bounty programs. it's not a place to complain about things you don't like. Meta/instagram has made a design decision here. just because you don't like it, doesn't mean it's a vulnerability.

It is a vulnerability. You the user are just vulnerable to them...

Re: Instagram can track anything you do on any website in their in-app browser

#110

Post by plif »

kart23 wrote: post #103

surprised this is at the top of HN. isn’t it obvious that every app does this? tiktok, snapchat, even linkedin all open links in their built-in browser and can track what you’re doing. click open in safari if you’re doing anything more than visiting a single page.

Yep, this is a feature, not just for tracking but also containment when navigating to external links. Big reason why all of those apps and others aggressively push users from web to mobile.
Post reply on HN