Let websites framebust out of native apps • Hacker News Board

Re: Let websites framebust out of native apps

#131

Post by ccouzens » Thu, Aug 11, 2022, 12:25 PM UTC

There have been a couple of these posts recently and they all contain the same flaw.

They talk about their experience on an iPhone and assume it's true on all ecosystems.

It's not true for mine (Firefox and Android). When following a link from Gmail it opens embedded within the Gmail app and the site has access to the same cookies as if I'd opened it in the browser. And it's trivial and seamless to then open into full Firefox (position in page and form values are kept).

I think Chrome Android is more or less the same too.

Re: Let websites framebust out of native apps

#132

Post by throwaway14356 » Thu, Aug 11, 2022, 12:29 PM UTC

neilv wrote: post #54

The article starts with historical anecdote from 1996, and talks about later frame-busting JS. At the time, you could also bust out of frames before JS was widely supported, simply by setting your HTML `A` element `target` attributes to `_top`. If you were already generating your HTML back then, including having a function to generate a link, this was possibly a one-line change. If you did this HTML-only frame-bustin…

i've made a frameset site recently. With modern stuff you can have a single document display different content (or a frameset) depending on the name of the frame and push state a more representative url. This also solves the history navigation.

loading videos and pdf files into frames is also nice.

Re: Let websites framebust out of native apps

#133

Post by ocdtrekkie » Thu, Aug 11, 2022, 12:35 PM UTC

the_gipsy wrote: post #113

ocdtrekkie wrote: post #79

Earlier quoted context omitted.

So it sounds like the solution here is to not cater to Open Web Advocacy's particular flavor of advocacy as the article prescribes, but in fact, prohibit apps from using any webview except the official one provided by the OS.

Why do you come to that conclusion? The users want to open links in their browser - no matter if the link is in an email, chat message, or in an app.

That's a very large assumption, one I think is outright false considering the discussion I've read about this post. The issue is that apps are allowed to embed webviews to do malicious things.

Re: Let websites framebust out of native apps

#134

Post by ocdtrekkie » Thu, Aug 11, 2022, 12:42 PM UTC

kelnos wrote: post #107

ocdtrekkie wrote: post #79

Earlier quoted context omitted.

So it sounds like the solution here is to not cater to Open Web Advocacy's particular flavor of advocacy as the article prescribes, but in fact, prohibit apps from using any webview except the official one provided by the OS.

iOS already does this, and that hasn't solved the problem. The issue is that the system-provided webview (well, on iOS, one of the two of them) allows the native app full control over it. And on Android, that would mean Firefox couldn't use Gecko. Screw that.

See: https://news.ycombinator.com/item?id=32419845

iOS does have a restricted/safe webview experience, it just currently permits more custom ones. The solution presumably is to ban those.

Re: Let websites framebust out of native apps

#135

Post by throwaway14356 » Thu, Aug 11, 2022, 12:53 PM UTC

DaiPlusPlus wrote: post #24

mnutt wrote: post #23

Earlier quoted context omitted.

A few years ago I worked on a web-based augmented reality app intended to be shared by users through services that often displayed links in webviews. Newer SFSafariViewController worked fine but WKWebView failed silently in a way that was impossible to detect. There was no way to determine if you were in a WKWebView except: adding a hidden DOM node somewhere in the format “(123) 456-7890”, real safari would automatic…

> There was no way to determine if you were in a WKWebView except: adding a hidden DOM node somewhere in the format “(123) 456-7890”, real safari would automatically turn it into a detectable phone number link What about non-US users? And doesn't Android's browser do the same thing? Also, what happens if the page has ` ` or `window.open`? Does it always open in the same frame/window/target?

it does the same with phone numbers from other countries but if you hide it any phonenumber woud be fine.

perhaps important: it only changes the first instance on the page for me.

while this might work there is no reason linking phone numbers could not be made to work in embedded browsers.

after all, it is pretty dubious that customers wont be able to call you despite testing the contact page on a real phone

Re: Let websites framebust out of native apps

#136

Post by rawling » Thu, Aug 11, 2022, 1:06 PM UTC

ccouzens wrote: post #131

There have been a couple of these posts recently and they all contain the same flaw. They talk about their experience on an iPhone and assume it's true on all ecosystems. It's not true for mine (Firefox and Android). When following a link from Gmail it opens embedded within the Gmail app and the site has access to the same cookies as if I'd opened it in the browser. And it's trivial and seamless to then open into ful…

Gmail may do that, but Android still offers developers "a webview that is basically a detached Chrome tab" and "a webview that you control and add your own chrome around".

Instagram offers me a UI that looks quite different to Gmail, so I suspect it's still using the latter.

Re: Let websites framebust out of native apps

#137

Post by tinus_hn » Thu, Aug 11, 2022, 1:07 PM UTC

ramblerman wrote: post #117

SergeAx wrote: post #105

I see almost no reason to use mobile apps for Facebook, Instagram or Twitter today. Just use mobile web browser instead. The only thing is a dark mode for Facebook, but I believe it is achievable via DarkReader plugin for Firefox. Also, ad blockers are more or less working in browser, although Facebook is actively counteracts.

A lot of them detect it and try to force you. It's malicious as hell, but somehow allowed. For example reddit won't open a link it deems +18 through the web browser, and redirects you to use the app.

Ridiculously if you change to old.reddit.com it’s no problem at all.

Re: Let websites framebust out of native apps

#138

Post by rawling » Thu, Aug 11, 2022, 1:14 PM UTC

sneak wrote: post #72

sally1620 wrote: post #37

Apple could solve this problem in Webkit. But Android is more complicated. On Android, third-party browser engines are allowed. Google cannot prevent an app from shipping its own browser engine for in-app browsing experience.

Apple is incentivized not to solve this because presently app creators can hijack these links to open in their own native code app, provided: 1. they have paid to join the apple developer program 2. they have validated ownership of their URL's domain with apple 3. they have submitted to all of the censorship requirements of the apple App Store (failure to do this one is what destroyed Tumblr and the Hong Kong anti-po…

The other-people's-apps-opening-your-site-in-their-custom-webview-and-adulterating-it problem doesn't go away if you onboard with Apple, build an app & register your domain for Universal Links. The custom webview is quite capable of blocking ULs.

Re: Let websites framebust out of native apps

#139

Post by bastawhiz » Thu, Aug 11, 2022, 1:21 PM UTC

iOS aside, I'm not sure there's anything to be done here. Apps could simply embed their own browser engine that lets them use webviews in whatever unfettered way they want. And on iOS, it's not unlikely that Apple will be required to open their walled garden to other browser engines in the future.

Re: Let websites framebust out of native apps

#140

Post by jaywalk » Thu, Aug 11, 2022, 1:29 PM UTC

bastawhiz wrote: post #139

iOS aside, I'm not sure there's anything to be done here. Apps could simply embed their own browser engine that lets them use webviews in whatever unfettered way they want. And on iOS, it's not unlikely that Apple will be required to open their walled garden to other browser engines in the future.

> Apps could simply embed their own browser engine that lets them use webviews in whatever unfettered way they want.

The biggest pro for consumers in having an app store is that the store can set regulations on apps. If Google says apps can't do this, then it's effectively dead. Of course, that would rely on Google effectively policing it.