Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

See what JavaScript commands get injected through an in-app browser

krausefx.com

Post reply on HN
Print view View original

251–260 of 330 posts

Re: See what JavaScript commands get injected through an in-app browser

#251

Post by [deleted] »

hn_throwaway_99 wrote: post #232
deminature wrote: post #208

They're going to heavily lockdown WKWebView after the Instagram and Tiktok revelations, probably in iOS16.1. They may even remove it entirely and force people to use SFSafariViewController (heavily locked down web browser, opaque to developers other than URL). Best of luck to anyone that was using javascript injection for legitimate purposes, others have ruined it for everyone by abusing user trust.

I highly doubt this will happen. There are a ton of apps that use things like Cordova or Capacitor (usually for cross-platform purposes). What I could see them doing is making apps declare URLs that they need access to. Basically, you get full functionality on declared URLs, but if you are just using WebView for a "generic" in-app browser you lose the ability to inspect random pages.

[deleted]

Re: See what JavaScript commands get injected through an in-app browser

#252

Post by ytpete »

soheil wrote: post #118
paxys wrote: post #94

Earlier quoted context omitted.

They do a lot more than that. > TikTok iOS subscribes to every tap on any button, link, image or other component on websites rendered inside the TikTok app. > TikTok iOS uses a JavaScript function to get details about the element the user clicked on, like an image (document.elementFromPoint) And that's just a sample of the calls the author was able to find.

If I build an analytics company and build a product that my customers can use to "analyze" their users activity it'd almost be a total neglect on my end not to include common tracking mechanisms that are well documented like simple event hooks in js. I really don't get the rage against tiktok. What they do that is publicly known is not bad. Maybe there is something bad they're doing but these random HN top stories ar…

You're writing as if this is just analytics tracking a user's actions in their own UI. It's not! This is tracking actions users take, and data users enter, on 3rd-party websites.

That is not "what happens in Tiktok's app," as you put it in your reply. It may be hosted "in" the app in a technical sense, but the typical user who is fullscreen viewing a totally different website may not feel like they are "in" the app at all. I wouldn't bet that most users even get that there's a distinction between an in-app browser vs. opening a tab in the main OS browser (on Android at least, the back gesture takes you back to the app either way). Users almost certainly doesn't expect the original app to be able to read passwords and other text that they type on those 3rd-party sites.

Re: See what JavaScript commands get injected through an in-app browser

#253

Post by mrtksn »

deminature wrote: post #208

They're going to heavily lockdown WKWebView after the Instagram and Tiktok revelations, probably in iOS16.1. They may even remove it entirely and force people to use SFSafariViewController (heavily locked down web browser, opaque to developers other than URL). Best of luck to anyone that was using javascript injection for legitimate purposes, others have ruined it for everyone by abusing user trust.

IMHO the proper action would be to put the script injection and data access capability behind a user consent prompt.

"TIKTOK WOULD LIKE TO READ THE AND MODIFY THE CONTENTS OF THIS WEBSITE - ACCEPT/DENY"

For legitimate reasons, the app can inform the user about why they need to do this and the user can accept that and even better, they can implement legitimate APIs.

Re: See what JavaScript commands get injected through an in-app browser

#255

Post by int_19h »

jker wrote: post #218
xvector wrote: post #201

Earlier quoted context omitted.

TikTok is not a browser and has zero obligation to provide private communications. What you do inside TikTok's app is quite literally TikTok's business.

But when you click a link in the TikTok app, TikTok opens an in-app browser for you to view it in - and that’s where it’s gathering all the information. It’s a deceptive practice, since most users won’t realize that they’re not simply surfing a website as usual.

Not only that, but per the article, TikTok is the only popular app that does this while not providing an option to open the link in regular browser from within the built-in one.

Re: See what JavaScript commands get injected through an in-app browser

#256

Post by woutr_be »

lvturner wrote: post #234
daniel_iversen wrote: post #185

Earlier quoted context omitted.

Yeah, and both TikTok and DouYin are owned by ByteDance. In fact didn't Google on occasion create a crippled/censored version of its search for some time in mainland China or Hong Kong or something?

I think they did, but then found it too much effort to maintain (I think there was also some hacking scandal? I forget) For what it's worth HK internet presently uncensored, though ironically TikTok pulled out of the HK market as they felt it was too expensive to comply with Hong Kong laws given the size of the available market here. DouYin is still available in HK though -- not sure if DouYin is available in US/Euro…

I believe they pulled out because of the new national security law, which allows police to request data without any warrants.

It’s some somewhat ironic, because TikTok is Chinese owned, and so is the NSL.

Re: See what JavaScript commands get injected through an in-app browser

#257

Post by int_19h »

thevagrant wrote: post #49
danield9tqh wrote: post #41

Earlier quoted context omitted.

Sounds like the opposite of housing from a national security POV. If a Chinese national buys a house in the US, then the US has 'control' over their property. The US would want Chinese nationals to buy houses in the US.

In some countries housing supply is limited and the housing market can be messed with by influx of foreign ownership. Possibly less of an issue with US due to size of the country. Still, I think if someone can buy land here, we should be able to buy land there (within reason)?

Just tax the hell out of that property and use that money to build more housing. Much like many countries charge foreign students more and use that money to educate their own citizens.

Re: See what JavaScript commands get injected through an in-app browser

#258

Post by Traubenfuchs »

mrtksn wrote: post #253
deminature wrote: post #208

They're going to heavily lockdown WKWebView after the Instagram and Tiktok revelations, probably in iOS16.1. They may even remove it entirely and force people to use SFSafariViewController (heavily locked down web browser, opaque to developers other than URL). Best of luck to anyone that was using javascript injection for legitimate purposes, others have ruined it for everyone by abusing user trust.

IMHO the proper action would be to put the script injection and data access capability behind a user consent prompt. "TIKTOK WOULD LIKE TO READ THE AND MODIFY THE CONTENTS OF THIS WEBSITE - ACCEPT/DENY" For legitimate reasons, the app can inform the user about why they need to do this and the user can accept that and even better, they can implement legitimate APIs.

Yes, please give us more cookie consent banners!

Re: See what JavaScript commands get injected through an in-app browser

#259

Post by mrtksn »

Traubenfuchs wrote: post #258
mrtksn wrote: post #253

Earlier quoted context omitted.

IMHO the proper action would be to put the script injection and data access capability behind a user consent prompt. "TIKTOK WOULD LIKE TO READ THE AND MODIFY THE CONTENTS OF THIS WEBSITE - ACCEPT/DENY" For legitimate reasons, the app can inform the user about why they need to do this and the user can accept that and even better, they can implement legitimate APIs.

Yes, please give us more cookie consent banners!

See, you don't have to ask for consent if you don't want to do shady stuff. Websites don't have to have cookie banners if they don't want to track you across the web and apps don't have to have access web data prompt if they don't want access the browser data in the app.

PS: very convincing GPT-3 bot comment, exactly what a redditor on autopilot would write(according to the profile, the OP is a bot).

Re: See what JavaScript commands get injected through an in-app browser

#260

Post by hackernewds »

paxys wrote: post #21
sva_ wrote: post #9

I just don't understand how we can allow a Chinese social media app in the west, while any non-chinese social media apps aren't allowed there? Same with housing, why can Chinese nationals buy housing here, while I can't do so there?

People are going to reply to you with the usual "we are better than them", "we are a democracy" etc., but reciprocity clauses are very common in areas like international trade, travel, disarmament treaties, emissions control and lots more. In fact China would never have been allowed into the WTO (which happened in 2001) had they not made sweeping changes to their economy and assured the world that they would compete…

This is why we have fallen a decade behind on semiconductor dominance. the next wars will be won not by who owns the oil, but who owns the semis to drive the robots..
Post reply on HN