Live data from Hacker News

See what JavaScript commands get injected through an in-app browser

krausefx.com

191–200 of 330 posts

Re: See what JavaScript commands get injected through an in-app browser

#191
post #39

Earlier quoted context omitted.

Why is it unfair?

Taking a random stab: one argument could be that competition drives down profit margins. By reducing competition, China makes their tech artificially profitable locally, allowing them to compete in international markets on an uneven playing field.

It’s basically a subsidy to their tech and AI industry. Same effect as US corn subsidies making American junk food exports endemic.

Re: See what JavaScript commands get injected through an in-app browser

#192
post #9

I just don't understand how we can allow a Chinese social media app in the west, while any non-chinese social media apps aren't allowed there? Same with housing, why can Chinese nationals buy housing here, while I can't do so there?

Trump tried to ban TikTok (and quite a lot more), but he’s orange and bad, so Biden repealed it. And tariffs are racist, so there’s that. America is not functioning well at this point and nothing indicates it will improve.

Re: See what JavaScript commands get injected through an in-app browser

#195
post #21

Earlier quoted context omitted.

People are going to reply to you with the usual "we are better than them", "we are a democracy" etc., but reciprocity clauses are very common in areas like international trade, travel, disarmament treaties, emissions control and lots more. In fact China would never have been allowed into the WTO (which happened in 2001) had they not made sweeping changes to their economy and assured the world that they would compete…

"had they not made sweeping changes to their economy and assured the world that they would compete on a fair playing field, rules that they still (mostly) have to follow today. " This is really quite false. Rules are broken all the time, they are difficult to arbitrate, and often they are not. The CCP requires foreign entities to surrender critical IP, then hand it off to a state-backed competitors, they don't allow…

>they don't allow full ownership of local companies

That isn't completely true anymore.

"Foreign investors are now allowed to establish wholly foreign-owned enterprises for whole vehicle manufacturing, including special purpose vehicles, new energy vehicles, commercial vehicles and passenger vehicles."

https://www.iflr.com/article/2a647jipe3beiloc6xeyo/primer-ch...

Re: See what JavaScript commands get injected through an in-app browser

#196
post #13

I feel like there is a litany of the internet: "that which can be collected will be." That's been true since the beginning. What continues to surprise me is that people think only "bad guys" do it. This is why we continue to lock down browsers and provide ever narrower permission classes.

[deleted]

Re: See what JavaScript commands get injected through an in-app browser

#197
post #48

Earlier quoted context omitted.

> how we can allow a Chinese social media app in the west, while any non-chinese social media apps aren't allowed there? Because we are the West, and China is China. We have different laws and customs.

Why does that mean that a Chinese social media app can capture data unlawfully under GDPR, CCPA or or other regulations?

It doesn't.

If that is happening then cases under those legislation would succeed. But those legislation don't somehow magically forbid practices that people on HN don't like.

Re: See what JavaScript commands get injected through an in-app browser

#198
post #111

Earlier quoted context omitted.

Honestly, this type of discussion is seriously irritating, because it implies that TikTok is doing something unique that other apps aren't doing. Just as the article demonstrates, many western countries do the exact same thing that TikTok does, except TikTok seemingly takes it one step further (probably because of shoddy programming). Applying geographic-based arguments to technology is just a bandaid. The problem ne…

TikTok is brought up because it has an insane amount of influence on the culture and identity of a huge swath of people. Do you seriously believe that China, or any country, would not want to leverage such influence to persuade or alter the culture or a potential advisory? We all shit our pants because Russia used Meta, and American company, to influence the 2020 election. Imagine the same amount of data, a more accu…

Who are you, Xi Jinping? You basically word for word translated their foreign social media policy. Luckily we live in a capitalist free market, free competition ideology and not a heavy protectionist centrally influenced market economy here in the US.

Re: See what JavaScript commands get injected through an in-app browser

#199
post #44
post #9

I just don't understand how we can allow a Chinese social media app in the west, while any non-chinese social media apps aren't allowed there? Same with housing, why can Chinese nationals buy housing here, while I can't do so there?

Money. And I don't just mean the politicians. I mean downright to the pension funds, hedge funds, and retail investor. They are all long China and especially Chinese tech. If you start declaring war on Chinese tech you are going to obliterate a huge amount of money all to protect the privacy that US voters don't care about privacy in the least. So why would they do such a silly thing? National security? Please, the s…

If you want to protect the privacy of users then protect the privacy of users. Protecting the privacy only when China is the one invading privacy is not protecting the privacy of users.

Re: See what JavaScript commands get injected through an in-app browser

#200

So let me get this straight: If I click a link inside the Instagram app, that for whatever reason takes me to gmail or microsoft or wherever that requires authentication, and I decide to login on that page so I can view the link in question, Meta and TikTok are able to capture my credentials and ingest the data back in to their metrics and analytics pipelines? Is that even f*cking legal?

Can they really though?

I mean, this is literally XSS. And it's not just Facebook and Tiktok, unless this is a private API scummy apps can and are (I guarantee) doing this to steal user passwords and bank credentials. Your average person already needs to know that they can't type in their credentials unless the URL says facebook.com, now they also need to check the app is Safari. And you may not even need to enter credentials, a malicious app could just load my-bank.com and extract the cookies or local storage or send API requests.

If true...wow. That's a massive security oversight. But it seems to massive I'm not 100% convinced. Especially because websites are tightly sandboxed from other websites and apps are tightly sandboxed from other apps. Yeah you could in theory re-implement your own web browser in your app which looks and acts like Safari, but in practice Apple technically forbids other web-views, and it's really hard to fully implement a web browser and not make it immediately apparent anyways.

Post reply on HN