Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

See what JavaScript commands get injected through an in-app browser

krausefx.com

Post reply on HN
Print view View original

301–310 of 330 posts

Re: See what JavaScript commands get injected through an in-app browser

#301

Post by rawling »

hn_throwaway_99 wrote: post #232
deminature wrote: post #208

They're going to heavily lockdown WKWebView after the Instagram and Tiktok revelations, probably in iOS16.1. They may even remove it entirely and force people to use SFSafariViewController (heavily locked down web browser, opaque to developers other than URL). Best of luck to anyone that was using javascript injection for legitimate purposes, others have ruined it for everyone by abusing user trust.

I highly doubt this will happen. There are a ton of apps that use things like Cordova or Capacitor (usually for cross-platform purposes). What I could see them doing is making apps declare URLs that they need access to. Basically, you get full functionality on declared URLs, but if you are just using WebView for a "generic" in-app browser you lose the ability to inspect random pages.

Couldn't you just proxy everything through a host you own?

Re: See what JavaScript commands get injected through an in-app browser

#302

Post by mrtksn »

Traubenfuchs wrote: post #300
d1sxeyes wrote: post #297

Earlier quoted context omitted.

A lot of people getting upset that you're highlighting that the account is a bot. Before anyone else tells mrktsn off, please read the user's profile. https://news.ycombinator.com/user?id=Traubenfuchs I also think that the bot did a good job here.

Accusing authors of dissenting opinions of being bots is the definition of bad faith and fosters an unhealthy discussion culture.

bad bot

Re: See what JavaScript commands get injected through an in-app browser

#303

Post by rawling »

jacooper wrote: post #107
cwkoss wrote: post #45

Don't all in-app browsers do this? I think I read that instagram does the same.

No, AFAIK not on android. As it uses the default browser, just in webview mode.

iOS and Android both have equivalent "bad" webviews that can be tampered with and "good" webviews that can't. Instagram on Android uses the "bad" one.

Re: See what JavaScript commands get injected through an in-app browser

#304

Post by Traubenfuchs »

mrtksn wrote: post #302
Traubenfuchs wrote: post #300

Earlier quoted context omitted.

Accusing authors of dissenting opinions of being bots is the definition of bad faith and fosters an unhealthy discussion culture.

bad bot

I think it‘s hilarious he stood up for himself but I feel bad about his lack of self awareness.

Re: See what JavaScript commands get injected through an in-app browser

#305

Post by sippeangelo »

netheril96 wrote: post #159

I always hate in app browsers and always reopen them in Safari, for UX reasons. Now I hate them even more, with even stronger reasons.

I'd like to add that I haven't been able to find a way to escape the TikTok in-app browser on Android. There are no buttons, not even a URL bar to copy from.

Re: See what JavaScript commands get injected through an in-app browser

#306

Post by BoorishBears »

weird-eye-issue wrote: post #144
BoorishBears wrote: post #127

Earlier quoted context omitted.

To play devil's advocate... the most common way to end up in the in-app browser is to click an ad. Non-technical people don't have a concept of "in app browser sandboxing". In their minds they clicked on an ad, they're still inside TikTok, TikTok's UI is showing, TikTok will show prompts based on the content shown... they probably assume TikTok has access to that page? Honestly I'm more annoyed that Apple allows big…

How do you know that's the most common way? Because I doubt it is. People click links in chats and in their feeds way more than they click ads

That is completely wrong since most users cannot post a website link (hotlink if I need to spell that out...), let alone in a comment.

The only way for a non-ad link to be opened from comments is to copy it and paste it in your native browser.

Business accounts get a special link field that's part of their bio, so again, deeply embedded in TikTok... and those behave exactly like the ads do. TikTok has a permanent "Flag" UI on top of the site, they replace every page load with a TikTok spinner

As expected half the people outraged don't even know what they're outraged about.

Re: See what JavaScript commands get injected through an in-app browser

#307

Post by BoorishBears »

hef19898 wrote: post #206
BoorishBears wrote: post #105

Earlier quoted context omitted.

Apple exposes two ways to use an in app browser. One is a legacy method that gives you full control, the other gives the user a sandboxed browser with no interference from the app. TikTok isn't the only app abusing this. Instagram and Facebook will both do sneaky things like respond to the content of the page you're browsing (asking to save passwords in their own private keychain, showing context specific information…

There is a difference between tracking activities (bad enough) and reading everything you type .

People really want to force outrage on this, but after enough interaction with the ad (scrolling, clicking, typing) TikTok asks about your experience with the ad.

TikTok is not pretending to have opened your system browser, it goes very far in doing the opposite:

- Hides the normal browser UI

- Replaces every page load with a TikTok spinner

- Permanently places a TikTok header bar over the screen with a report content button tied to TikTok

Combine that with the fact so many people seem to not realize... the only links you can open with the browser are links sold with analytics (ie you can't post arbitrary links as a user commenting) and the outrage just doesn't add up.

A completely non-technical user going through that flow would expect that they're still in TikTok and are using TikTok not their browser

Re: See what JavaScript commands get injected through an in-app browser

#308

Post by soheil »

int_19h wrote: post #255
jker wrote: post #218

Earlier quoted context omitted.

But when you click a link in the TikTok app, TikTok opens an in-app browser for you to view it in - and that’s where it’s gathering all the information. It’s a deceptive practice, since most users won’t realize that they’re not simply surfing a website as usual.

Not only that, but per the article, TikTok is the only popular app that does this while not providing an option to open the link in regular browser from within the built-in one.

This is just an idiotic statement. Almost all social media apps do this. In addition apps like Yelp do this to the determent of business owners.

Re: See what JavaScript commands get injected through an in-app browser

#309

Post by soheil »

jker wrote: post #218
xvector wrote: post #201

Earlier quoted context omitted.

TikTok is not a browser and has zero obligation to provide private communications. What you do inside TikTok's app is quite literally TikTok's business.

But when you click a link in the TikTok app, TikTok opens an in-app browser for you to view it in - and that’s where it’s gathering all the information. It’s a deceptive practice, since most users won’t realize that they’re not simply surfing a website as usual.

Did you just wake up today after reading this article and learned about the existence of in-app browsers? This is a common practice by almost all social media apps.

Re: See what JavaScript commands get injected through an in-app browser

#310

Post by soheil »

tinus_hn wrote: post #279
soheil wrote: post #207

Earlier quoted context omitted.

What happens in tiktok app is very much tiktok's business and their IP. Are you possibly conflating tiktok tracking its own users within its app with somehow it gaining access to the OS itself and tracking users at that level? That is clearly not happening as far as what is publicly known as much as stories like this want you to believe for it to be the case.

Would consider it right for a browser to snoop on every page opened, every link clicked, every character typed and send it to the cloud without informing the user?

No my point is why single out tiktok when every other social app is doing the same exact thing for all we know in their in-app browsers. Just because the researcher in this particular article happened to go after tiktok?
Post reply on HN