Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram can track anything you do on any website in their in-app browser

krausefx.com

Post reply on HN
Print view View original

161–170 of 469 posts

Re: Instagram can track anything you do on any website in their in-app browser

#161

Post by navbaker »

thaumasiotes wrote: post #118
navbaker wrote: post #90

Earlier quoted context omitted.

It is infuriating that I can't browse certain Reddit pages because they want me to "use the app so they know I'm over 18". I first ran into this in my current attempt to play through Dark Souls 3. It seems like the community there has a lot of good discussions about beating certain bosses, but for some reason, Reddit has decided that the content in that sub-reddit needs age verification and they wall it behind the ap…

> It is infuriating that I can't browse certain Reddit pages because they want me to "use the app so they know I'm over 18". Nothing's stopping you. There is no such message on old.reddit.com.

I had no idea this existed

Re: Instagram can track anything you do on any website in their in-app browser

#163

Post by saagarjha »

tolmasky wrote: post #131
dilDDoS wrote: post #47

I generally don't see any appeal to in-app browsers in the first place. They often have extremely broken navigation controls (i.e. attempting to swipe back to a previous page usually just returns back to the app), block the ability to navigate to a specific URL, content blockers don't work, don't allow opening "smart links" that would typically open in another app if opened from a normal browser, etc. From what I'm g…

It's even worse than that: 1. Nothing you visit gets saved in your history. So many times I'm looking through my history thinking "I could have sworn I read an article about this..." only to eventually discover (if I'm lucky) that it was in Twitter's stupid in-app browser. But oh well, never going to find that article again! The irony of the APP knowing everything you visit but you never getting to remember what you…

Twitter uses SFSafariViewController, which does not give Twitter access to what you browse.

Re: Instagram can track anything you do on any website in their in-app browser

#164

Post by wepple »

graham1776 wrote: post #152

I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to al…

Tangential, but these same links have always been a great way to break out of poorly designed kiosk systems.

I recall noodling with a huge interactive display on the side of a bus stop that had an embedded map, and surely enough the TOS link launched a browser, and from there you could use the Save As dialog to get to anything to execute

Re: Instagram can track anything you do on any website in their in-app browser

#165

Post by shawnz »

thrashh wrote: post #138
zippergz wrote: post #125

Earlier quoted context omitted.

I'm sure this has gotten better as people have become more used to smartphones, but I worked on a popular app for a big company a number of years ago, and we would send people out to Safari to open links. The number of customer service calls we got from people who couldn't figure out how to get back to the app after that was ASTOUNDING. We eventually gave in and did an in-app browser. Not only did it get rid of that…

I’m a developer and I remember turning off in-app browsers whenever I could and I absolutely hated it My browser would get littered with old tabs and coming back to the app for a small click became a hassle On the off-chance I do want to save a link, I know I can just open it in my browser anyway So I much prefer in-app browsers as a user and a developer

I think Android's "custom tabs" functionality is a great compromise. Apps can open a separate instance of the user's default browser which becomes part of the app's activity stack and doesn't share tabs with the main browser instance. However the UI and navigation are controlled by the browser, not the app. Cookies and local storage are also shared with the main browser instance, allowing seamless SSO without the app being able to intercept the secrets.

AFAIK iOS supports something similar, but only for authentication use cases.

Re: Instagram can track anything you do on any website in their in-app browser

#166

Post by davet91 »

graham1776 wrote: post #152

I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to al…

The in-app browsers could use a domain whitelist if parental controls are turned on.

Re: Instagram can track anything you do on any website in their in-app browser

#168

Post by saagarjha »

pantulis wrote: post #66
darknoon wrote: post #41

Earlier quoted context omitted.

Safari webview (WebKit) is what it's describing

The key aspect here is that Instagram's app is using a Safari Webview but somehow it is injecting its own tracking pixel on the HTML body wether the target website had it or not. Which honestly does not surprise me, what surprises me is that Apple allows this. I think there was a time where certain Javascript capabilities were present in Safari but not in Safari Webview and there was certain outrage. Perhaps a soluti…

To what? Disable the ability to inject JavaScript into the web view?

Re: Instagram can track anything you do on any website in their in-app browser

#169

Post by saagarjha »

benbristow wrote: post #69

One thing I've noticed is that content-blockers/adblock don't seem to work within the Facebook/Instagram etc. in-app browsers so I usually end up jumping out of them anyway.

Content blockers only work in Safari and SFSafariViewController.

Re: Instagram can track anything you do on any website in their in-app browser

#170

Post by jefftk »

ezfe wrote: post #88
jefftk wrote: post #73

Earlier quoted context omitted.

I thought Facebook/Instagram used a WebView for their in-app browser on both iOS and Android? Which means they can do anything they want, including exfiltrate your browsing.

I meant "of course Facebook doesn't [use Safari View Controller]". WebView ≠ Safari View Controller. Safari View Controller keeps the users cookies from Safari and prevents this behavior. For most apps, keeping users logged in without leaving the app is preferred, so they give up the ability to inspect the contents of the page.

Sorry, rereading your comment that's exactly what you said and I just misread!
Post reply on HN