I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to al…
It is interesting how this would apply for custom browser engines in the future of iOS.
I'm sure this has gotten better as people have become more used to smartphones, but I worked on a popular app for a big company a number of years ago, and we would send people out to Safari to open links. The number of customer service calls we got from people who couldn't figure out how to get back to the app after that was ASTOUNDING. We eventually gave in and did an in-app browser. Not only did it get rid of that…
I’m a developer and I remember turning off in-app browsers whenever I could and I absolutely hated it My browser would get littered with old tabs and coming back to the app for a small click became a hassle On the off-chance I do want to save a link, I know I can just open it in my browser anyway So I much prefer in-app browsers as a user and a developer
I feel like half the time I encounter them is when I’m already in my browser, click a link (probably search results), it opens the app, the app proceeds to display content in an in app browser.. and I’m just left think why, WhY, WHY?
I generally don't see any appeal to in-app browsers in the first place. They often have extremely broken navigation controls (i.e. attempting to swipe back to a previous page usually just returns back to the app), block the ability to navigate to a specific URL, content blockers don't work, don't allow opening "smart links" that would typically open in another app if opened from a normal browser, etc. From what I'm g…
I'm sure this has gotten better as people have become more used to smartphones, but I worked on a popular app for a big company a number of years ago, and we would send people out to Safari to open links. The number of customer service calls we got from people who couldn't figure out how to get back to the app after that was ASTOUNDING. We eventually gave in and did an in-app browser. Not only did it get rid of that…
Same issue when your website opens a link in a new tab on mobile: many mobile users have no idea how to get back. The back button does not work and they don't know how to close/switch tabs. They're barely aware of the concept of a tab.
Websites need cookie notices, but apps can track your full web usage (albeit within the in-app browser) without any such notice or opt in? Doesn't seem like this would be legal. Anyone know how this could be compliant in the EU? It's also frustrating that on an android device you can't simply disable in-app browsers globally.
I'm not familiar with the Instagram signup flow but it may very well be that the user did opt-in at one point. The opt-in would of course only be valid if there's also a clear "reject" option.
I thought Facebook/Instagram used a WebView for their in-app browser on both iOS and Android? Which means they can do anything they want, including exfiltrate your browsing.
I meant "of course Facebook doesn't [use Safari View Controller]". WebView ≠ Safari View Controller. Safari View Controller keeps the users cookies from Safari and prevents this behavior. For most apps, keeping users logged in without leaving the app is preferred, so they give up the ability to inspect the contents of the page.
> Safari View Controller keeps the users cookies from Safari
It does not, because apps decided to abuse it for fingerprinting.
It’s really painful to see all of these encryption holes in every product we use daily. Apple claims privacy, yet your whole phone sits unencrypted on their server ready to be served to anyone who asks (assuming you back up your phone to iCloud)
My understanding is that iCloud backups are encrypted[1]. [1]: https://support.apple.com/en-us/HT202303
Encrypted but they have the keys so they can serve it to anyone who asks. That’s why “end-to-end” is subsequently mentioned as an “additional” step for certain data. It should all be end-to-end like iCloud Keychain is, at least on demand.
I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to al…
The in-app browsers could use a domain whitelist if parental controls are turned on.
That could be an "easy" fix where you could disable use of in-app browsers through Screen Time options.
I have always hated inapp browsers. I am a degoogled android user, and I despise any app that defaults browsing to inapp browser. If you are a developer who is defaulting to inapp browser, please stop doing it. (Biggest reason I hate inapp browsing is my ad-blocker and custom ublock origin scripts don't work correctly.)
surprised this is at the top of HN. isn’t it obvious that every app does this? tiktok, snapchat, even linkedin all open links in their built-in browser and can track what you’re doing. click open in safari if you’re doing anything more than visiting a single page.