Live data from Hacker News

Instagram can track anything you do on any website in their in-app browser

krausefx.com

341–350 of 469 posts

Re: Instagram can track anything you do on any website in their in-app browser

#341

As a provider is it possible to defend against this with a Content Security Policy or does this mechanism override the site’s CSP?

Not only would CSP block it, but this type of behavior only strengthens Apple's decision to not allow third party rendering engines. Could you imagine the privacy nightmare that would ensue if Facebook could release a browser that bypassed any and all safeguards implemented by site operators?

Re: Instagram can track anything you do on any website in their in-app browser

#342

Earlier quoted context omitted.

Or maybe... just don't give your kids an iPhone? Seriously, using the internet/computers should be treated with the same level of caution as grown-up scissors or fillet knives; powerful tools, but they need training to avoid hurting yourself with them. If this is what you're worried about, why are you even giving them a small computer in the first place? Your kids will always be more cunning than your security policy…

Brilliant insight. Could you please convince my children's school that they do not need a smartphone? Because they f'ing mandate it and I have not found a way around this yet.

What happens if you refuse?

Re: Instagram can track anything you do on any website in their in-app browser

#343
post #335
post #311

Earlier quoted context omitted.

As a kid I loved doing this in every museum/library/other place that always had 'locked down' interactive Windows systems back in my youth. One of my favorite ones was in a museum where I was with a friend, and there was a PC. We were bored and wanted to play some flash game, but we only had access to a mouse, and clicking links inside the locked fullscreen browser. With enough clicks we got to google and managed to…

Although using the on-screen keyboard in accessibility settings would have been easier (if that existed back then), I like your creative young mind.

We couldn't access anything but the browser window in fullscreen, only using the mouse. No start menu, tray icons, keyboard shortcuts, etc.

I'm sure there's like 100 different ways to break these bad Windows kiosks so that you'd eventually end up being able to access the accessibility settings, but it wasn't directly accessible to us.

Re: Instagram can track anything you do on any website in their in-app browser

#344

Only Instagram? Every app maker who makes an in app browser can see what you do, that’s the point of embedding it. And why not? You arrive there because of a link in the container app you clicked on. They want to see what you do with the link they gave you. Otherwise only Google/Apple can see what you do with it. Someone can see what you do with the link no matter what.

Not necessarily. If they’re using a WKWebView, they can’t see what you’re doing, which is why Safari Autofill remains enabled in some but not all app-embedded web views.

This is not correct. WKWebView can be made to report back clicks and URL loads, inject JS etc. Eg here is the doc for the navigation delegate: https://developer.apple.com/documentation/webkit/wknavigatio...

Re: Instagram can track anything you do on any website in their in-app browser

#345

Earlier quoted context omitted.

Or maybe... just don't give your kids an iPhone? Seriously, using the internet/computers should be treated with the same level of caution as grown-up scissors or fillet knives; powerful tools, but they need training to avoid hurting yourself with them. If this is what you're worried about, why are you even giving them a small computer in the first place? Your kids will always be more cunning than your security policy…

They’re given chrome books in school and can’t complete assignments without them. Now what?

They're just linux, provide your own. There are many options.

Re: Instagram can track anything you do on any website in their in-app browser

#346

Earlier quoted context omitted.

I naively assumed that they were using a WebView object and that Apple had tight controls over source code injection. Silly me!

Apple has deprecated but not yet removed the legacy web embeds that app developers use to spy on and track their users.

They haven’t deprecated web views at all: https://developer.apple.com/documentation/webkit/wkwebview

WKWebView can indeed be used to spy on users - clicks can be intercepted, URLs sniffed, and custom JS injected (including a way to call back to the app’s runtime via a WebKit message passing mechanism). Considering all other iOS browsers (ok maybe some still run UIWebView) have been made using this component (because App Store reviews enforce this), it’s clear that it has to provide extensive control over displayed contents.

Re: Instagram can track anything you do on any website in their in-app browser

#347

Every app that uses an in-app browser (which is most of them) can do this. This is a clickbait headline that relies on "Blue Company Bad" sentiments.

> The [iOS] Instagram app injects their tracking code into every website shown, including when clicking on ads, enabling them monitor all user interactions

The allegation isn't that Instagram can do this but that they are.

Re: Instagram can track anything you do on any website in their in-app browser

#348

Earlier quoted context omitted.

You claim to be extremely liberal in your social views but then in the next breath make the assumptions that difficulty forming relationships today is significantly greater than in the past and further that this fact is due to effects that are caused (ultimately) by viewing porn. Those are both very socially conservative viewpoints and I have yet to find scientific data (or anything else I'd consider even remotely re…

I'm not GP, but you first say: > Those are both very socially conservative viewpoints and I have yet to find scientific data (or anything else I'd consider even remotely reliable) that back either of them up, particularly the second one. but then go on to yourself list many probably reasons why that's the case: > how do you suppose to show that this change is due to porn instead of, say, the prevalence of dating apps…

You rightly point out that absence of evidence is not evidence of absence. But then neither is it evidence. Which leaves both sides at: we don't really know.

Anecdotes are worth crap all, because people will bring up examples for either side thus cancelling each other out.

But your last sentence irked me.

If you side with liberty and tolerance and advise friends and family not to do "bad thing", they can say they appreciate your advice, tell you to GTFO and do it anyway.

Once government steps in and makes such things illegal, there are much bigger stakes at play.

To me, that is a big difference.

Re: Instagram can track anything you do on any website in their in-app browser

#349

Earlier quoted context omitted.

I'm glad to see someone mention addicts. I feel as if internet addiction, and especially subsets of it such as porn addiction, aren't given enough weight by either the addiction treatment community or the technical community. Before someone accuses me of being a conservative religious zealot as tends to happen when anyone denounces porn, I'll say that I'm far from a puritan and am extremely liberal in my social views…

What does it mean to be addicted to porn? Daily viewing? Hourly? Constant?

No post body was provided.

Re: Instagram can track anything you do on any website in their in-app browser

#350

Earlier quoted context omitted.

Or maybe... just don't give your kids an iPhone? Seriously, using the internet/computers should be treated with the same level of caution as grown-up scissors or fillet knives; powerful tools, but they need training to avoid hurting yourself with them. If this is what you're worried about, why are you even giving them a small computer in the first place? Your kids will always be more cunning than your security policy…

Brilliant insight. Could you please convince my children's school that they do not need a smartphone? Because they f'ing mandate it and I have not found a way around this yet.

Flip phones still exist and allow access to call in emergencies as well as text with friends.
Post reply on HN