Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

See what JavaScript commands get injected through an in-app browser

krausefx.com

Post reply on HN
Print view View original

281–290 of 330 posts

Re: See what JavaScript commands get injected through an in-app browser

#281

Post by tinus_hn »

MBCook wrote: post #225
netheril96 wrote: post #159

I always hate in app browsers and always reopen them in Safari, for UX reasons. Now I hate them even more, with even stronger reasons.

Unfortunately I think they’re very popular with unsophisticated users. I’ve heard stories about companies getting a ton of support emails because someone clicked on an article link shown in $someApp, the user was booted to Safari, and didn’t know how to get back to where they were before. I’ve heard of developers adding the in-app thing despite hating it personally just to reduce the support burden.

If you navigate out of an app iOS adds a ‘back’ link on the top left of the screen automatically. This is not going to cause ‘a ton of support emails’; your stories probably are from versions of iOS when they didn’t do that, which is so long ago I couldn’t even find how long.

Re: See what JavaScript commands get injected through an in-app browser

#282

Post by [deleted] »

deminature wrote: post #208

They're going to heavily lockdown WKWebView after the Instagram and Tiktok revelations, probably in iOS16.1. They may even remove it entirely and force people to use SFSafariViewController (heavily locked down web browser, opaque to developers other than URL). Best of luck to anyone that was using javascript injection for legitimate purposes, others have ruined it for everyone by abusing user trust.

[deleted]

Re: See what JavaScript commands get injected through an in-app browser

#283

Post by jacooper »

systoll wrote: post #235
jacooper wrote: post #87

Why on earth is this even allowed in IOS in the first place ? Why do apps have the ability to control and change the browser? Instead of using the default one? Like android.

Android is in basically the same situation. Obviously both Android & iOS let you open things in the default browser. iOS has SFSafariViewController, which more-or-less corresponds to Chrome Custom Tabs on Android. These basically make a browser UI that is in the of the app for the purposes of multitasking/app-switching, but which is controlled by the browser. Devs can't inject code into these. And both have WebViews,…

I haven't seen any app to use webview for external links, it always use chrome custom tabs.

Re: See what JavaScript commands get injected through an in-app browser

#285

Post by paxys »

roebk wrote: post #284

Can this be circumvented by a very strict Content-Security-Policy?

It’s on the browser to enforce CSP headers. In this case the browser itself is doing the malicious script injection. Think of it as a browser extension, just running without your consent. It’s up to the browser - not the website - to reject it.

Re: See what JavaScript commands get injected through an in-app browser

#289

Post by dymk »

adrianh wrote: post #269
MBCook wrote: post #225

Earlier quoted context omitted.

Unfortunately I think they’re very popular with unsophisticated users. I’ve heard stories about companies getting a ton of support emails because someone clicked on an article link shown in $someApp, the user was booted to Safari, and didn’t know how to get back to where they were before. I’ve heard of developers adding the in-app thing despite hating it personally just to reduce the support burden.

The solution here is for the company to make a proper help page explaining that, then respond to all the support emails with a link to the help page. No need to poison the well for everybody else due to wanting to avoid a "support burden." My own product/company has a few common issues like this, and the help page strategy works fine. Answering emails for these types of things is not a big deal as long as you have st…

No layperson such as a TikTok user is ever going to read a help article. Much less an error message popup.

Re: See what JavaScript commands get injected through an in-app browser

#290

Post by the_gipsy »

pyentropy wrote: post #215

I hate that if I send Wordle or something cool to a friend that uses localStorage they lose their progress/settings once they leave the chat app. So frustrating to even explain to people that this thing they are scrolling isn't their own, Safari/Chrome!

It's just another piece in how Apple sabotaged the web.
Post reply on HN