See what JavaScript commands get injected through an in-app browser • Hacker News Board

Re: See what JavaScript commands get injected through an in-app browser

#201

Post by xvector » Fri, Aug 19, 2022, 2:03 AM UTC

mr_toad wrote: post #148

soheil wrote: post #118

Earlier quoted context omitted.

If I build an analytics company and build a product that my customers can use to "analyze" their users activity it'd almost be a total neglect on my end not to include common tracking mechanisms that are well documented like simple event hooks in js. I really don't get the rage against tiktok. What they do that is publicly known is not bad. Maybe there is something bad they're doing but these random HN top stories ar…

If you sold a phone that sent call details back to the manufacturer you’d likely get locked up. Tik tok are not a party to these communications, and they’re not a carrier or service provider. What they’re doing is wire tapping.

TikTok is not a browser and has zero obligation to provide private communications. What you do inside TikTok's app is quite literally TikTok's business.

Re: See what JavaScript commands get injected through an in-app browser

#202

Post by croes » Fri, Aug 19, 2022, 2:06 AM UTC

insane_dreamer wrote: post #142

jacooper wrote: post #109

Earlier quoted context omitted.

Instagram and Facebook do the same thing.

not nearly to the same degree

How do you know?

Re: See what JavaScript commands get injected through an in-app browser

#203

Post by [deleted] » Fri, Aug 19, 2022, 2:09 AM UTC

BonoboIO wrote: post #171

If anybody else would do this, the app would be taken down immediately from the App Store. Probably the developer account banned too. It is Spyware. Nothing else.

[deleted]

Re: See what JavaScript commands get injected through an in-app browser

#204

Post by croes » Fri, Aug 19, 2022, 2:10 AM UTC

upupandup wrote: post #68

And on top of this we are seeing scary trends emerge on TikTok: they are able to mobilize youth into anti-social activities like stealing cars or creating weapons. All they have is a small notice at top of the videos with a disclaimer. ex) Kiaboyz wreaking havoc in Columbus as videos of stealing Kia/Hyundai cars went viral on TikTok Suffice to say that the bar isn't very high in America. This type of video would neve…

That's a problem of social media a such. Remember the Tide Pod challenge?

Re: See what JavaScript commands get injected through an in-app browser

#205

Post by hef19898 » Fri, Aug 19, 2022, 2:11 AM UTC

xvector wrote: post #201

mr_toad wrote: post #148

Earlier quoted context omitted.

If you sold a phone that sent call details back to the manufacturer you’d likely get locked up. Tik tok are not a party to these communications, and they’re not a carrier or service provider. What they’re doing is wire tapping.

TikTok is not a browser and has zero obligation to provide private communications. What you do inside TikTok's app is quite literally TikTok's business.

You are aware of the various privacy laws in a lot of countries?

Re: See what JavaScript commands get injected through an in-app browser

#206

Post by hef19898 » Fri, Aug 19, 2022, 2:12 AM UTC

BoorishBears wrote: post #105

mark_l_watson wrote: post #88

I can’t quite figure this out: it sounds like if you click a link in someone’s TikTok content, the in app browser can read any text entered on that site using the in app browser. Does just not entering any keyboard input in the in app browser mitigate this? Does Apple Lockdown help in this situation? I thought that typical TikTok use just involved scrolling and watching video content. Are users who only view content…

Apple exposes two ways to use an in app browser. One is a legacy method that gives you full control, the other gives the user a sandboxed browser with no interference from the app. TikTok isn't the only app abusing this. Instagram and Facebook will both do sneaky things like respond to the content of the page you're browsing (asking to save passwords in their own private keychain, showing context specific information…

There is a difference between tracking activities (bad enough) and reading everything you type.

Re: See what JavaScript commands get injected through an in-app browser

#207

Post by soheil » Fri, Aug 19, 2022, 2:13 AM UTC

mr_toad wrote: post #148

soheil wrote: post #118

Earlier quoted context omitted.

If I build an analytics company and build a product that my customers can use to "analyze" their users activity it'd almost be a total neglect on my end not to include common tracking mechanisms that are well documented like simple event hooks in js. I really don't get the rage against tiktok. What they do that is publicly known is not bad. Maybe there is something bad they're doing but these random HN top stories ar…

If you sold a phone that sent call details back to the manufacturer you’d likely get locked up. Tik tok are not a party to these communications, and they’re not a carrier or service provider. What they’re doing is wire tapping.

What happens in tiktok app is very much tiktok's business and their IP.

Are you possibly conflating tiktok tracking its own users within its app with somehow it gaining access to the OS itself and tracking users at that level? That is clearly not happening as far as what is publicly known as much as stories like this want you to believe for it to be the case.

Re: See what JavaScript commands get injected through an in-app browser

#208

Post by deminature » Fri, Aug 19, 2022, 2:17 AM UTC

They're going to heavily lockdown WKWebView after the Instagram and Tiktok revelations, probably in iOS16.1. They may even remove it entirely and force people to use SFSafariViewController (heavily locked down web browser, opaque to developers other than URL). Best of luck to anyone that was using javascript injection for legitimate purposes, others have ruined it for everyone by abusing user trust.

Re: See what JavaScript commands get injected through an in-app browser

#209

Post by ssalka » Fri, Aug 19, 2022, 2:18 AM UTC

I think the big question is, what are the event handlers doing exactly? I'm definitely not defending any of these companies but it just seems fundamentally unclear what gets done with the data. The presumption is that the event data is passed to some private storage against users' consent. But for all we know it's also possible there are automated filters in place to detect sensitive information and drop/obfuscate it. Still, I wouldn't count on that.

I will say that it doesn't look great to have a `keypress` listener on the window/document...certainly that's not used for anything good.

Re: See what JavaScript commands get injected through an in-app browser

#210

Post by MrMetlHed » Fri, Aug 19, 2022, 2:20 AM UTC

netheril96 wrote: post #159

I always hate in app browsers and always reopen them in Safari, for UX reasons. Now I hate them even more, with even stronger reasons.

It seems like there should be a setting to make this the default. Sometimes I'll navigate a bit within the in-app browser after clicking on a link from like Twitter or something, and I'd much rather it pop open Firefox or something that I can actually trust. Now it sounds like Apple and Google should start putting warnings on these things by default, yeesh.