Instagram can track anything you do on any website in their in-app browser • Hacker News Board

Re: Instagram can track anything you do on any website in their in-app browser

#311

Post by orlp » Wed, Aug 10, 2022, 10:01 PM UTC

wepple wrote: post #164

graham1776 wrote: post #152

I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to al…

Tangential, but these same links have always been a great way to break out of poorly designed kiosk systems. I recall noodling with a huge interactive display on the side of a bus stop that had an embedded map, and surely enough the TOS link launched a browser, and from there you could use the Save As dialog to get to anything to execute

As a kid I loved doing this in every museum/library/other place that always had 'locked down' interactive Windows systems back in my youth.

One of my favorite ones was in a museum where I was with a friend, and there was a PC. We were bored and wanted to play some flash game, but we only had access to a mouse, and clicking links inside the locked fullscreen browser. With enough clicks we got to google and managed to copy/paste letter by letter the name of a game site in the search field and play some games.

Re: Instagram can track anything you do on any website in their in-app browser

#312

Post by djxfade » Wed, Aug 10, 2022, 10:04 PM UTC

autoexec wrote: post #185

fleddr wrote: post #173

Earlier quoted context omitted.

Same issue when your website opens a link in a new tab on mobile: many mobile users have no idea how to get back. The back button does not work and they don't know how to close/switch tabs. They're barely aware of the concept of a tab.

> They're barely aware of the concept of a tab. What mobile browsers actually have tabs that look like tabs? Honest question, I've only ever used firefox on android. If the others handle tabs anything like firefox does tabs are way more intuitive on a PC.

iOS does have visible tabs, identical to desktop Safari. But only in landscape mode

Re: Instagram can track anything you do on any website in their in-app browser

#313

Post by jacquesm » Wed, Aug 10, 2022, 10:04 PM UTC

smoldesu wrote: post #195

graham1776 wrote: post #152

I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to al…

Or maybe... just don't give your kids an iPhone? Seriously, using the internet/computers should be treated with the same level of caution as grown-up scissors or fillet knives; powerful tools, but they need training to avoid hurting yourself with them. If this is what you're worried about, why are you even giving them a small computer in the first place? Your kids will always be more cunning than your security policy…

Brilliant insight. Could you please convince my children's school that they do not need a smartphone? Because they f'ing mandate it and I have not found a way around this yet.

Re: Instagram can track anything you do on any website in their in-app browser

#314

Post by djxfade » Wed, Aug 10, 2022, 10:05 PM UTC

nocsi wrote: post #243

kccqzy wrote: post #189

Earlier quoted context omitted.

The original SFSafariViewController did share cookies with regular Safari. The documentation says > In iOS 9 and 10, it shares cookies and other website data with Safari. I was also also disappointed that they removed it in iOS 11. But it's still a step-up from other even more horrible in-app browsers like in Instagram, which are implemented with WKWebView. I refuse to read anything in those in-app browsers; I always…

lol what you’re describing as a ‘feature’ is actually insecure & vulnerable. There are strong security reasons why Apple mandates WKWebView and bans SFSafari.

Not really, SFSafariViewController was a "view" only controller. The app couldn't communicate or extract data from it.

Re: Instagram can track anything you do on any website in their in-app browser

#315

Post by sroussey » Wed, Aug 10, 2022, 10:07 PM UTC

underwater wrote: post #304

smoldesu wrote: post #195

Earlier quoted context omitted.

Or maybe... just don't give your kids an iPhone? Seriously, using the internet/computers should be treated with the same level of caution as grown-up scissors or fillet knives; powerful tools, but they need training to avoid hurting yourself with them. If this is what you're worried about, why are you even giving them a small computer in the first place? Your kids will always be more cunning than your security policy…

This is such a naive take. I assume you don't have kids or teens? Children don't exist in a neat subservient bubble. They have peers, social pressures, see advertising, consume television and movies. Our kid's school had everyone buy an iPad. Already, at pre-phone age, so much socialisation has moved into the digital space. FaceTime, iMessage, Roblox, etc. I was going to say banning phones would be like a kid in the…

Actually, TV was severely limited as were video games. We were told to go outside and not come back until it was getting dark.

Re: Instagram can track anything you do on any website in their in-app browser

#316

Post by amenghra » Wed, Aug 10, 2022, 10:10 PM UTC

graham1776 wrote: post #152

I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to al…

In the early 1990s, we used to break out of Macintosh's AtEase at our middle school by writing a two line MacBasic program which launched Finder. We would then bring games on floppies. Everything old is new again!

Re: Instagram can track anything you do on any website in their in-app browser

#317

Post by freedomben » Wed, Aug 10, 2022, 10:16 PM UTC

d110af5ccf wrote: post #309

CodeSgt wrote: post #250

Earlier quoted context omitted.

I'm glad to see someone mention addicts. I feel as if internet addiction, and especially subsets of it such as porn addiction, aren't given enough weight by either the addiction treatment community or the technical community. Before someone accuses me of being a conservative religious zealot as tends to happen when anyone denounces porn, I'll say that I'm far from a puritan and am extremely liberal in my social views…

You claim to be extremely liberal in your social views but then in the next breath make the assumptions that difficulty forming relationships today is significantly greater than in the past and further that this fact is due to effects that are caused (ultimately) by viewing porn. Those are both very socially conservative viewpoints and I have yet to find scientific data (or anything else I'd consider even remotely re…

I'm not GP, but you first say:

> Those are both very socially conservative viewpoints and I have yet to find scientific data (or anything else I'd consider even remotely reliable) that back either of them up, particularly the second one.

but then go on to yourself list many probably reasons why that's the case:

> how do you suppose to show that this change is due to porn instead of, say, the prevalence of dating apps such as Tinder? Or any number of other factors including things like job stability, housing prices (and thus perceived security of living situation), and where people choose to spend their free time (for example going out on the town in the past versus perhaps doomscrolling twitter and watching netflix).

Completing a study to prove GP's claims is a herculean effort that may not even be possible due to ethical concerns. (i.e. you'll have to take a person who has never been exposed to porn and then get them addicted, so you can see if it ruins their life).

Any claim without data should definitely be looked at skeptically (including in this case), but it's also important to remember that absence of evidence is not evidence of absence.

Also there's a lot of life experience out there of people who will tell you that they have a porn addiction that is causing them problems with relationships. One of my friends just got divorced from his wife of 20 years because he has developed a porn addiction and won't give it up or get any treatment (his wife is not ok with it).

I'm about as socially liberal as they come, (and I would never support a ban on porn nor pretty much anything, but that's a topic for another day), but I've seen and heard way too many anecdotes about the devastation that porn can have on a person to ignore it.

I don't think there's a big difference between a social conservative (who typically want to use government force to restrict access to "bad things") and someone who sides with liberty and tolerance but would advise friends and family not to do "bad thing."

Re: Instagram can track anything you do on any website in their in-app browser

#318

Post by rawling » Wed, Aug 10, 2022, 10:22 PM UTC

pantulis wrote: post #269

saagarjha wrote: post #168

Earlier quoted context omitted.

To what? Disable the ability to inject JavaScript into the web view?

Yes. Is there a legitimate use case for injecting arbitrary Javascript by the native app? (Honest question)

Apps that use html for their UI and JS hooks to trigger touch ID, access the keychain etc.

Re: Instagram can track anything you do on any website in their in-app browser

#319

Post by freedomben » Wed, Aug 10, 2022, 10:23 PM UTC

flappyeagle wrote: post #258

CodeSgt wrote: post #250

Earlier quoted context omitted.

I'm glad to see someone mention addicts. I feel as if internet addiction, and especially subsets of it such as porn addiction, aren't given enough weight by either the addiction treatment community or the technical community. Before someone accuses me of being a conservative religious zealot as tends to happen when anyone denounces porn, I'll say that I'm far from a puritan and am extremely liberal in my social views…

What does it mean to be addicted to porn? Daily viewing? Hourly? Constant?

Just my opinion of course, but (like drugs and alcohol) putting a reasonable and generic metric on it is really hard, so I would instead ask generic questions that I would ask about other things like:

1. Do you find yourself craving it?

2. Do you continually feel the need to increase your intake? (i.e. developing a tolerance)

3. Would you be embarrassed if a like-minded friend knew about your habit?

4. If you were suddenly cut off from it for a few days, how would it make you feel?

Re: Instagram can track anything you do on any website in their in-app browser

#320

Post by PenguinCoder » Wed, Aug 10, 2022, 10:23 PM UTC

prmoustache wrote: post #40

PenguinCoder wrote: post #21

Earlier quoted context omitted.

> use the sites. Which are increasingly user hostile, if not down right impossible to view on mobile. Go try using Reddit or Twitter on your Mobile browser.

Actually twitter is fine on a mobile browser provided you use an account. What I miss is the multi-container extension on fennec/firefox mobile. I keep using those sites in incognito mode but that mean I can only use one at a time.

> provided you use an account.

Within 3 days of registering a new account they will prompt you 'for a phone number, because we detected security issues with your usage'. Don't know how having a phone number helps with security issues like that, but again -user hostile-.

I'm not creating a Twitter account just to read their public site, because they are user hostile and privacy invasive.