Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram can track anything you do on any website in their in-app browser

krausefx.com

Post reply on HN
Print view View original

191–200 of 469 posts

Re: Instagram can track anything you do on any website in their in-app browser

#191

Post by joshstrange »

navanchauhan wrote: post #67
joshu wrote: post #19

i don't understand why apple allows in-app browsers.

Do you want to cripple the entire app industry? Apps built using React Nativ / Flutter e.t.c use the WebView to render themselves. So they’re basically already running “in-app browsers” But then how do you differentiate when the app is rendering its own view rather than another website? You could apply some restrictions like has nowadays where you need extra security privileges (I think) to render pages / execute scr…

I think the clear answer is to only allow local/whitelisted domains that you can prove you own. I work on Capacitor/Cordova apps regularly and only allowing local code would allow for them to continue to work and close this loophole. Anytime I open an external page I do it in SFSafariViewController which doesn't have the ability to inject code or snoop.

Re: Instagram can track anything you do on any website in their in-app browser

#192

Post by darth_avocado »

lrvick wrote: post #133
darth_avocado wrote: post #94

Earlier quoted context omitted.

I frankly am surprised why anyone would think otherwise? The “In-app” in the name should kind of give it away that it is, after all, in the app. Anything you do will be available for the app to track.

Consider the overwhelming majority of users are technically illiterate. Everything is just magic scrolling machines people learned to trust from watching people they trust use them.

I would sympathize with all of the illiterate users. But the person who reported this and the people on HN discussing the article would be considered a little more technologically literate I would assume.

Re: Instagram can track anything you do on any website in their in-app browser

#193

Post by tolmasky »

saagarjha wrote: post #163
tolmasky wrote: post #131

Earlier quoted context omitted.

It's even worse than that: 1. Nothing you visit gets saved in your history. So many times I'm looking through my history thinking "I could have sworn I read an article about this..." only to eventually discover (if I'm lucky) that it was in Twitter's stupid in-app browser. But oh well, never going to find that article again! The irony of the APP knowing everything you visit but you never getting to remember what you…

Twitter uses SFSafariViewController, which does not give Twitter access to what you browse.

Right, I know. I mentioned SFSafariViewController in my post. I am saying, in the 9 years since SFSafariViewController was introduced, Apple could have made the experience with SFSafariViewController better, for example by having pages you visit in a SFSafariViewController get saved into your normal browsing history (this can be done without giving Twitter access to anything, it can simply notify the OS of an internal navigation, and then the OS can add that item to your Safari history. If SFSafariViewController runs out-of-process, then it can be even simpler than that). I then wouldn't have to keep a weird mapping in my head of what "app" I read an article in to ever get back to it. This would go a long way in closing the gap with the benefits you get from opening a link in Safari proper instead of viewing it in-app.

Re: Instagram can track anything you do on any website in their in-app browser

#195

Post by smoldesu »

graham1776 wrote: post #152

I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to al…

Or maybe... just don't give your kids an iPhone?

Seriously, using the internet/computers should be treated with the same level of caution as grown-up scissors or fillet knives; powerful tools, but they need training to avoid hurting yourself with them. If this is what you're worried about, why are you even giving them a small computer in the first place? Your kids will always be more cunning than your security policy (a hard pill to swallow for HN users), so control their access to technology unless you're ready to have a serious sit-down discussion about the internet, personal privacy, and all that jazz. Put yourself in their shoes; if you're given a small black brick with an indeterminate number of capabilities, wouldn't your response be pushing it as far as it can go? I know that was my reaction when I was a kid, after buying a Pentium desktop at a garage sale.

Re: Instagram can track anything you do on any website in their in-app browser

#196

Post by Fogest »

graham1776 wrote: post #152

I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to al…

I have a browser based game I play that makes use of many userscripts and browser extensions to further improve/enhance the game. However mobile users suffer from a problem of not having such extras. There is a very nice app someone made on Android and iOS that uses in-app browsers in order to be able to add a lot of custom things.

There are many useful instances for the in-app browsers and I don't think they should be removed because of some bad actors. It's similar to how Android has had password managers making use of autofill tools via accessibility tools. Android was butchering that access, but luckily started adding some official autofill support.

I don't think removing capabilities in the favour of "safety" is usually the right approach in my opinion.

Re: Instagram can track anything you do on any website in their in-app browser

#197

Post by smoldesu »

CharlesW wrote: post #188
rahkiin wrote: post #171

Earlier quoted context omitted.

It is interesting how this would apply for custom browser engines in the future of iOS.

This class of security problem is also a great reason to never allow custom browser engines.

...why wouldn't it be possible? iOS has application sandboxing, just drop all DNS requests for the webview that's outside a developer-defined namespace. I'm sure someone at Apple could find a better way to implement it, but we shouldn't accept lame excuses like this. Apple has 200 billion dollars in cash, this is not an advanced problem space.

Re: Instagram can track anything you do on any website in their in-app browser

#198

Post by tolmasky »

dwighttk wrote: post #187
tolmasky wrote: post #131

Earlier quoted context omitted.

It's even worse than that: 1. Nothing you visit gets saved in your history. So many times I'm looking through my history thinking "I could have sworn I read an article about this..." only to eventually discover (if I'm lucky) that it was in Twitter's stupid in-app browser. But oh well, never going to find that article again! The irony of the APP knowing everything you visit but you never getting to remember what you…

You might consider using Twitter in Safari instead of the app based on those irritations.

On everything other than iOS (desktop and iPad), I either use Twitter in the browser or it is reasonable to just have links open in the main browser. Using Twitter in Safari on iOS (on the phone, to distinguish it from iPadOS), you end up with kind of the reverse problem of needing to fish around for Twitter in tabs. If Safari on iOS had a better "save web app"/site-specific browser story, then this could possibly remedy some of these problems (or if they implemented some of the basic ideas I described, like storing history).

Re: Instagram can track anything you do on any website in their in-app browser

#199

Post by rchaud »

darth_avocado wrote: post #94
dilDDoS wrote: post #47

I generally don't see any appeal to in-app browsers in the first place. They often have extremely broken navigation controls (i.e. attempting to swipe back to a previous page usually just returns back to the app), block the ability to navigate to a specific URL, content blockers don't work, don't allow opening "smart links" that would typically open in another app if opened from a normal browser, etc. From what I'm g…

I frankly am surprised why anyone would think otherwise? The “In-app” in the name should kind of give it away that it is, after all, in the app. Anything you do will be available for the app to track.

Considering that a simple iOS privacy disclosure dialog box cost FB $10bn in revenue loss, I'd say there are a lot of things users would be surprised to know when it comes to how apps work and what they collect.

Re: Instagram can track anything you do on any website in their in-app browser

#200

Post by upupandup »

andix wrote: post #62

It would be interesting if this violates rights of the website owner the user is visiting. I known that embedding content of other websites into your own via an iframe can be a copyright violation. And what Meta does here is more or less like an iframe.

It isn't. By that logic any browser is liable for violating ToS of websites, which btw isn't the law and you are not obligated to follow anyhow.

This of course is a different case for corporations with a dedicated legal team.

Post reply on HN