Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram can track anything you do on any website in their in-app browser

krausefx.com

Post reply on HN
Print view View original

61–70 of 469 posts

Re: Instagram can track anything you do on any website in their in-app browser

#61

Post by samtheprogram »

dilDDoS wrote: post #47

I generally don't see any appeal to in-app browsers in the first place. They often have extremely broken navigation controls (i.e. attempting to swipe back to a previous page usually just returns back to the app), block the ability to navigate to a specific URL, content blockers don't work, don't allow opening "smart links" that would typically open in another app if opened from a normal browser, etc. From what I'm g…

Ironically the whole point of it originally was sandboxing, and it’s true at least on iOS. Thus, you won’t be logged into the same sites within an in-app browser, and clicking a link from within an app (whether it appears to be an link or not) can’t automatically connect you to cookies and any other tracking from your actual browser.

Re: Instagram can track anything you do on any website in their in-app browser

#62

Post by andix »

It would be interesting if this violates rights of the website owner the user is visiting. I known that embedding content of other websites into your own via an iframe can be a copyright violation. And what Meta does here is more or less like an iframe.

Re: Instagram can track anything you do on any website in their in-app browser

#63

Post by eCa »

dylan604 wrote: post #56
macNchz wrote: post #42

Earlier quoted context omitted.

I actually find Twitter’s mobile web app experience to be pretty good–they don’t nag me to install the app every 5 seconds, it’s reasonably performant, the back button works properly and even mostly preserves scroll position. All of the core functionality is there, except new features like Fleets I don’t care about anyway. I use it regularly and have been pretty impressed. Reddit on the other hand is absolutely hosti…

I all I ever see when following Twitter links on mobile is the lower 1/3 of the screen with a "it's better in the app" banner bullshit. What web app from Twitter are you seeing that doesn't have that?

I have the same experience. When I want to access twitter I use " rel="nofollow">https://nitter.net/

Re: Instagram can track anything you do on any website in their in-app browser

#64

Post by jhgg »

joshu wrote: post #39
nkozyra wrote: post #24

Earlier quoted context omitted.

You mean custom ones, right? WebViews are incredibly useful, but it definitely seems like implementing your own browser gives people a false sense of security, like they've been sandboxed when they haven't. What would be nice here is a permission requirement if you're injecting code into a browser view.

webviews for clicking arbitrary links in apps like instagram or gmail are absurdly restrictive. i lose my context, cookies, and regular tools (bookmarks are gone, sharing often overridden, etc)

This is why https://developer.apple.com/documentation/safariservices/sfs... exists and why the blog post advocates for using it.

Re: Instagram can track anything you do on any website in their in-app browser

#65

Post by notatoad »

>I’ve disclosed this issue with Meta through their Bug Bounty Program

lol. and this is why companies can be hesitant to run bug bounty programs. it's not a place to complain about things you don't like. Meta/instagram has made a design decision here. just because you don't like it, doesn't mean it's a vulnerability.

Re: Instagram can track anything you do on any website in their in-app browser

#66

Post by pantulis »

darknoon wrote: post #41
oconnor663 wrote: post #33

Earlier quoted context omitted.

Last I heard (years ago), iOS forced everyone to use Safari for webviews, which lots of people also complained about. Did that change? Or is the Safari webview the subject of this story?

Safari webview (WebKit) is what it's describing

The key aspect here is that Instagram's app is using a Safari Webview but somehow it is injecting its own tracking pixel on the HTML body wether the target website had it or not.

Which honestly does not surprise me, what surprises me is that Apple allows this. I think there was a time where certain Javascript capabilities were present in Safari but not in Safari Webview and there was certain outrage.

Perhaps a solution would be to run the webview through Safaris content blocker engine?

Re: Instagram can track anything you do on any website in their in-app browser

#67

Post by navanchauhan »

joshu wrote: post #19

i don't understand why apple allows in-app browsers.

Do you want to cripple the entire app industry? Apps built using React Nativ / Flutter e.t.c use the WebView to render themselves. So they’re basically already running “in-app browsers”

But then how do you differentiate when the app is rendering its own view rather than another website? You could apply some restrictions like has nowadays where you need extra security privileges (I think) to render pages / execute scripts not on the same domain

Otherwise you can always open safari from all of these in-app browser views and they could implement a toggle which forces all of them to be opened in Safari automatically

Re: Instagram can track anything you do on any website in their in-app browser

#68

Post by bitwize »

dylan604 wrote: post #60
replygirl wrote: post #52

Earlier quoted context omitted.

since years ago apple added the little back button to return you to your previous app, even webview is dead weight. apple should only allow one, in some special context, that's so counterintuitive to implement that only frameworks e.g. react native can justify the effort

And yet, we're normally seeing Apple === BAD because they limit everything to just the one Apple thing. Am I actually seeing requests for Apple to limit willingly?

Most of Hackernews doesn't understand why Apple is the #1 tech company in the world -- they're still in the "no wireless, less space than a Nomad, lame" mindset.

Re: Instagram can track anything you do on any website in their in-app browser

#70

Post by replygirl »

dylan604 wrote: post #60
replygirl wrote: post #52

Earlier quoted context omitted.

since years ago apple added the little back button to return you to your previous app, even webview is dead weight. apple should only allow one, in some special context, that's so counterintuitive to implement that only frameworks e.g. react native can justify the effort

And yet, we're normally seeing Apple === BAD because they limit everything to just the one Apple thing. Am I actually seeing requests for Apple to limit willingly?

in 2015 i got an iphone for a job, then i made it my daily driver because i liked the restrictions. now my phones last four years instead of one
Post reply on HN