Live data from Hacker News

Instagram can track anything you do on any website in their in-app browser

krausefx.com

151–160 of 469 posts

Re: Instagram can track anything you do on any website in their in-app browser

#151
post #64

Earlier quoted context omitted.

This is why https://developer.apple.com/documentation/safariservices/sfs... exists and why the blog post advocates for using it.

That was a great update, but still not a true browser. No tabs, no bookmarks. Why should the website be restricted to one tab? Just open Safari and be done with it.

exactly

Re: Instagram can track anything you do on any website in their in-app browser

#152
I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children.

Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to all the "apparent" unsafe sites, there are still ways to access the unfiltered internet inside of these safe apps.

How? Usually buried in App Settings. Almost all apps use some instance of an in-app browser to (lazily) reference thier privacy policies, EULAs, or TOCs. A buried link leads to a homepage, leads to an instagram link, leads to an unfiltered internet. Yes they are long, inefficient paths to reach the internet, but curious (or motivated) individuals or children will use almost any app to reach the internet. Even boring apps like MS Teams or adding a Gmail account to iOS mail uses a secret in-app browser.

This obviously presents a problem: should developers restrict any and all app access to in-app browsers, or leave policing to individuals/parents? An easy approach is to disable the in-app browser functionality in iOs, but obviously with grave cost to developers. At the same time, at what cost is in-app browser functionality being implemented.

Re: Instagram can track anything you do on any website in their in-app browser

#153
post #19

i don't understand why apple allows in-app browsers.

Do you want to cripple the entire app industry? Apps built using React Nativ / Flutter e.t.c use the WebView to render themselves. So they’re basically already running “in-app browsers” But then how do you differentiate when the app is rendering its own view rather than another website? You could apply some restrictions like has nowadays where you need extra security privileges (I think) to render pages / execute scr…

it’s a bad experience for opening external links. i don’t care that it’s not easy to get to.

and no, not all apps do this. tiktok does not offer an escape, and instagram hides it behind two clicks.

Re: Instagram can track anything you do on any website in their in-app browser

#154
post #47

I generally don't see any appeal to in-app browsers in the first place. They often have extremely broken navigation controls (i.e. attempting to swipe back to a previous page usually just returns back to the app), block the ability to navigate to a specific URL, content blockers don't work, don't allow opening "smart links" that would typically open in another app if opened from a normal browser, etc. From what I'm g…

I'm sure this has gotten better as people have become more used to smartphones, but I worked on a popular app for a big company a number of years ago, and we would send people out to Safari to open links. The number of customer service calls we got from people who couldn't figure out how to get back to the app after that was ASTOUNDING. We eventually gave in and did an in-app browser. Not only did it get rid of that…

[deleted]

Re: Instagram can track anything you do on any website in their in-app browser

#156
Meta (Facebook, Instagram, Whatsapp) is the sneakiest, impertinent and most evil company of all them all.

Much worse than the tracking and spying is how Meta does everything to make people addicted to their slot-machine like services and thereby destroying their mental health. Especially harmful for kids.

The world would be a much better place without it.

Re: Instagram can track anything you do on any website in their in-app browser

#157

As a provider is it possible to defend against this with a Content Security Policy or does this mechanism override the site’s CSP?

External sources yes, preventing an app to inject inline HTML and JavaScript is tricky.

You can block all inline scripts via CSP.

Re: Instagram can track anything you do on any website in their in-app browser

#158
post #47

I generally don't see any appeal to in-app browsers in the first place. They often have extremely broken navigation controls (i.e. attempting to swipe back to a previous page usually just returns back to the app), block the ability to navigate to a specific URL, content blockers don't work, don't allow opening "smart links" that would typically open in another app if opened from a normal browser, etc. From what I'm g…

My assumption is that it is a Product managers play to get people to stay in the app for longer. If you give people a link out of the app, then they are less likely to come back after.

You get a bump in engagement and time spent in the app at the cost of UX.

Re: Instagram can track anything you do on any website in their in-app browser

#159

Earlier quoted context omitted.

I'm sure this has gotten better as people have become more used to smartphones, but I worked on a popular app for a big company a number of years ago, and we would send people out to Safari to open links. The number of customer service calls we got from people who couldn't figure out how to get back to the app after that was ASTOUNDING. We eventually gave in and did an in-app browser. Not only did it get rid of that…

I’m a developer and I remember turning off in-app browsers whenever I could and I absolutely hated it My browser would get littered with old tabs and coming back to the app for a small click became a hassle On the off-chance I do want to save a link, I know I can just open it in my browser anyway So I much prefer in-app browsers as a user and a developer

I'm the opposite, I hate in app browsers as a user. It's like having a bunch of extra poorly made web browsers that can only have one tab, and block me from using one of my apps. When I'm trying to find a tab I had open now I have to search both my browser tabs and every app in my app switcher. And if I want to keep using an app but it's showing an in-app browser I have to either throw away my tab, or navigate a menu to migrate it to my real browser to save for later, then switch back to the app and close the in app browser, and only then can I continue to use the app. It's a constant pain.

Re: Instagram can track anything you do on any website in their in-app browser

#160
post #47

I generally don't see any appeal to in-app browsers in the first place. They often have extremely broken navigation controls (i.e. attempting to swipe back to a previous page usually just returns back to the app), block the ability to navigate to a specific URL, content blockers don't work, don't allow opening "smart links" that would typically open in another app if opened from a normal browser, etc. From what I'm g…

It's even worse than that: 1. Nothing you visit gets saved in your history. So many times I'm looking through my history thinking "I could have sworn I read an article about this..." only to eventually discover (if I'm lucky) that it was in Twitter's stupid in-app browser. But oh well, never going to find that article again! The irony of the APP knowing everything you visit but you never getting to remember what you…

> instead they just made "SFSafariViewController" which does none of these things

Actually, SFSafariViewController acts as a full Safari without giving any ability to the developer to inject scripts or receive data to track you(except for ad taps through Private Click Measurement). It's actually a nice solution, it shares cookies(non-session ones) with Safari.

Post reply on HN