This is good. It's the price for using the site. They're not alone!
See what JavaScript commands get injected through an in-app browser
211–220 of 330 posts
Re: See what JavaScript commands get injected through an in-app browser
#212Apple and Google have guidelines about what apps are/aren't allowed to if they want to be on their app store. "Protecting the user" is supposed to be one reasons they take a 30% cut of all in app purchases. Apple even uses this as an excuse to not allow side loading apps. How are they not blocking this?
Thought Apple was the bastion of consumer privacy. Apparently removing TikTok though is not commercially beneficial for them not to mention the elephant in the room: Apple Finds Its Next Big Business: Showing Ads on Your iPhone https://www.bloomberg.com/news/newsletters/2022-08-14/apple-...
Apple hashes and sends over wire every bin you run, if that's a 'bastion' then RMS was right.
Re: See what JavaScript commands get injected through an in-app browser
#213They're going to heavily lockdown WKWebView after the Instagram and Tiktok revelations, probably in iOS16.1. They may even remove it entirely and force people to use SFSafariViewController (heavily locked down web browser, opaque to developers other than URL). Best of luck to anyone that was using javascript injection for legitimate purposes, others have ruined it for everyone by abusing user trust.
+1 thanks for the info - it makes sense that Apple would try to mitigate this on their platform.
I use Apple’s new Lockdown Mode on the beta iOS 16 and iPadOS 16. I generally like it. It largely disables arbitrary JavaScript, as far as I know. A few times a week, I will turn off Lockdown temporarily for a few minutes for a web site if there are any problems. This is usually Amazon.com’s Kindle preview feature.
Re: See what JavaScript commands get injected through an in-app browser
#214I always hate in app browsers and always reopen them in Safari, for UX reasons. Now I hate them even more, with even stronger reasons.
Yeah - I never want an in-app browser. I wish it could be broadly disabled at least as an option, though I'd be fine with apple just removing the capability entirely.
It's particularly annoying with account cookies and such when I'm already authenticated in the normal browser.
Re: See what JavaScript commands get injected through an in-app browser
#215I hate that if I send Wordle or something cool to a friend that uses localStorage they lose their progress/settings once they leave the chat app.
So frustrating to even explain to people that this thing they are scrolling isn't their own, Safari/Chrome!
Re: See what JavaScript commands get injected through an in-app browser
#216You can ID users based on the cadence and relative timing between keypresses to identify anyone regardless of their login credentials.
You can also detect bots, even skillfully crafted ones.
Re: See what JavaScript commands get injected through an in-app browser
#217Earlier quoted context omitted.
If you sold a phone that sent call details back to the manufacturer you’d likely get locked up. Tik tok are not a party to these communications, and they’re not a carrier or service provider. What they’re doing is wire tapping.
TikTok is not a browser and has zero obligation to provide private communications. What you do inside TikTok's app is quite literally TikTok's business.
Unfortunately, the issue of consent is extremely muddy as it's easy to argue that the average person is not informed enough about the issue at hand, and so they have improperly developed expectations when engaging with the TikTok browser.
Lack of consent and lack of transparency, make this whole thing pretty messed up.
Re: See what JavaScript commands get injected through an in-app browser
#218Earlier quoted context omitted.
If you sold a phone that sent call details back to the manufacturer you’d likely get locked up. Tik tok are not a party to these communications, and they’re not a carrier or service provider. What they’re doing is wire tapping.
TikTok is not a browser and has zero obligation to provide private communications. What you do inside TikTok's app is quite literally TikTok's business.
But when you click a link in the TikTok app, TikTok opens an in-app browser for you to view it in - and that’s where it’s gathering all the information. It’s a deceptive practice, since most users won’t realize that they’re not simply surfing a website as usual.
Re: See what JavaScript commands get injected through an in-app browser
#219I just don't understand how we can allow a Chinese social media app in the west, while any non-chinese social media apps aren't allowed there? Same with housing, why can Chinese nationals buy housing here, while I can't do so there?
Because west operate under different systems.
West has for while being about free trade free market global capitalism. Where as China is using much more controlled approach.
Fundamentally west can't get too faraway from these ideals or it will end up destroying its hegemony. Huawei has already been banned, but what comes after social media? And if some action is taken, will other countries start banning western imports specially cultural and services?
Re: See what JavaScript commands get injected through an in-app browser
#220I can’t quite figure this out: it sounds like if you click a link in someone’s TikTok content, the in app browser can read any text entered on that site using the in app browser. Does just not entering any keyboard input in the in app browser mitigate this? Does Apple Lockdown help in this situation? I thought that typical TikTok use just involved scrolling and watching video content. Are users who only view content…
Apple exposes two ways to use an in app browser. One is a legacy method that gives you full control, the other gives the user a sandboxed browser with no interference from the app. TikTok isn't the only app abusing this. Instagram and Facebook will both do sneaky things like respond to the content of the page you're browsing (asking to save passwords in their own private keychain, showing context specific information…
Apple needs to give us power-users the option to decide whether to load such web contents (in apps) in either SFSafariViewController (sandboxed) or WKWebView (fully exposed). This is especially critical when, for example, payment processors load your net banking portal inside apps (a common mode of online payment in India) - unless it is sandboxed, the app and / or payment processor has complete access to your netbanking credentials.