Ah so that's why they insist so much on opening every single link in their crappy in-app browser. I decompiled and patched Instagram for Android, and I did try, among other things, to bypass that browser (and gave up because my approach somehow mysteriously broke navigation in the app), but the thought that they're using it to track you has never once crossed my mind.
Instagram can track anything you do on any website in their in-app browser
211–220 of 469 posts
Re: Instagram can track anything you do on any website in their in-app browser
#212It would be interesting if this violates rights of the website owner the user is visiting. I known that embedding content of other websites into your own via an iframe can be a copyright violation. And what Meta does here is more or less like an iframe.
It isn't. By that logic any browser is liable for violating ToS of websites, which btw isn't the law and you are not obligated to follow anyhow. This of course is a different case for corporations with a dedicated legal team.
First Instagram is not a browser.
And second the browser manufacturer (usually) doesn’t make any money by tracking their users. They provide them with a tool, a browser.
There is the browser Brave, that replaces ads on websites (and makes some profit with that), and there are some serious legal issues coming with that.
Re: Instagram can track anything you do on any website in their in-app browser
#213Earlier quoted context omitted.
It is interesting how this would apply for custom browser engines in the future of iOS.
This class of security problem is also a great reason to never allow custom browser engines.
How about services like luna, stadia, etc which can render any sort of interactive content (typically games)?
Re: Instagram can track anything you do on any website in their in-app browser
#214I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to al…
We used to exploit these types of paths when school IT admins didn't know how to filter traffic properly but knew to block proxies.
Re: Instagram can track anything you do on any website in their in-app browser
#215I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to al…
Tangential, but these same links have always been a great way to break out of poorly designed kiosk systems. I recall noodling with a huge interactive display on the side of a bus stop that had an embedded map, and surely enough the TOS link launched a browser, and from there you could use the Save As dialog to get to anything to execute
Also on Android-based kiosks, you can get into the OS through the on-screen keyboard if they're using it. Try long tapping the buttons around the spacebar, one of them would usually get you into system settings. From there you can as much as completely take over the device if you wish.
Re: Instagram can track anything you do on any website in their in-app browser
#216I'm confused I thought Apple only allowed web browsing via Safari... "2.5.6 Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript." If apps can use their own in app browser, why can't say Brave for example, create an app that does very little, except it browses the web with its own in app browser?
This just forbids developers to write their own browser engine. It is OK to use the iOs provided webbrowser as a control in your app.
Re: Instagram can track anything you do on any website in their in-app browser
#217Earlier quoted context omitted.
> They don't sync with my main browser states such as authenticated sessions. Under what circums do you want this?
> Under what circums do you want this? Click on "Sign In/Up with Google". Opens in app browser. Not logged in even though I'm with Safari. Type email. Type password. Get password wrong. Type password again. Get text/email with 2FA code. Every single time. Or Gmail app. Click link. Open in-app browser. Not logged in.
I am not a fan of the "Password Fabric" - if you are, you are not my friend...
Re: Instagram can track anything you do on any website in their in-app browser
#218>I’ve disclosed this issue with Meta through their Bug Bounty Program lol. and this is why companies can be hesitant to run bug bounty programs. it's not a place to complain about things you don't like. Meta/instagram has made a design decision here. just because you don't like it, doesn't mean it's a vulnerability.
>just because you don't like it, doesn't mean it's a vulnerability.
Technical Vuln or Business Vuln?
Re: Instagram can track anything you do on any website in their in-app browser
#219Of course. That's the point of in-app browsers right?
Re: Instagram can track anything you do on any website in their in-app browser
#220Earlier quoted context omitted.
...why wouldn't it be possible? iOS has application sandboxing, just drop all DNS requests for the webview that's outside a developer-defined namespace. I'm sure someone at Apple could find a better way to implement it, but we shouldn't accept lame excuses like this. Apple has 200 billion dollars in cash, this is not an advanced problem space.
Then the app can use DOH, or tunnel DNS requests over something else - a non-safari browser engine wouldn’t have to use system DNS by any means…
I thought non-safari browser engines were banned