5 ms·

Judging by how sluggish and annoying the HSBC app is, I think it is a web app framed in a thin launcher from the app store. I.e. it downloads a bunch of javasc

Judging by how sluggish and annoying the HSBC app is, I think it is a web app framed in a thin launcher from the app store. I.e. it downloads a bunch of javascript/html/css and that executes within a UIWebView/WKWebView. Using caching and localStorage, you can construct such an app to not need to download everything on each launch. The reason that's allowed is because everything executes within a sandboxed browser environment. No native code is downloaded.

robk 10y ago
Is it possible to do that and use the fingerprint sensor for login in a secure way? I thought the same as you until they enabled Touch login.
- Klathmon 10y ago
  There's no reason why they can't have the native portion do the authentication and just have it return a signed token to the JS portion which forwards it to the server.
- jinglebells 10y ago
  Yeah, https://github.com/EddyVerbruggen/cordova-plugin-touch-id https://github.com/EddyVerbruggen/cordova-plugin-touch-id shows how.
mikeash 10y ago
> The reason that's allowed is because everything executes within a sandboxed browser environment. No native code is downloaded. That's the same thing Rollout does. In fact, iOS apps can't download and run native code. The OS won't let you mark pages as executable unless they're appropriately signed, and only Apple has those keys.
- deleted 10y ago
  [deleted]
- orbitur 10y ago
  If they're using JSC, then they can definitely download JS and execute native methods. They could subclass any UIKit object and make it conform to JSExport. Done, now they're "running native code."
  - mikeash 10y ago
    Sure, and an app displaying a web page using WebView can provide hooks that allow doing that sort of thing too. Neither one is downloading native code.
    - orbitur 10y ago
      Only UIWebView, which is going away soon. But surely you can see the difference between executing limited actions inside a web view, and making available any native method to a web view.
      - mikeash 10y ago
        WKWebView allows the app to execute arbitrary JS within the loaded page, and intercept URL loads and other actions made by JS code. That's all you need to build a bridge. I don't see any fundamental difference here. Both (UI|WK)WebView and JSC allow bridging. Neither one grants full access to JS code automatically, the programmer has to put some effort into it. And even if there is some important difference, neither one is native code which is what I was disputing above.

robk 10y ago

Is it possible to do that and use the fingerprint sensor for login in a secure way? I thought the same as you until they enabled Touch login.

Klathmon 10y ago
There's no reason why they can't have the native portion do the authentication and just have it return a signed token to the JS portion which forwards it to the server.
jinglebells 10y ago
Yeah, https://github.com/EddyVerbruggen/cordova-plugin-touch-id https://github.com/EddyVerbruggen/cordova-plugin-touch-id shows how.

mikeash 10y ago

> The reason that's allowed is because everything executes within a sandboxed browser environment. No native code is downloaded. That's the same thing Rollout does. In fact, iOS apps can't download and run native code. The OS won't let you mark pages as executable unless they're appropriately signed, and only Apple has those keys.

deleted 10y ago
[deleted]
orbitur 10y ago
If they're using JSC, then they can definitely download JS and execute native methods. They could subclass any UIKit object and make it conform to JSExport. Done, now they're "running native code."
- mikeash 10y ago
  Sure, and an app displaying a web page using WebView can provide hooks that allow doing that sort of thing too. Neither one is downloading native code.
  - orbitur 10y ago
    Only UIWebView, which is going away soon. But surely you can see the difference between executing limited actions inside a web view, and making available any native method to a web view.
    - mikeash 10y ago
      WKWebView allows the app to execute arbitrary JS within the loaded page, and intercept URL loads and other actions made by JS code. That's all you need to build a bridge. I don't see any fundamental difference here. Both (UI|WK)WebView and JSC allow bridging. Neither one grants full access to JS code automatically, the programmer has to put some effort into it. And even if there is some important difference, neither one is native code which is what I was disputing above.