25 ms·

Instagram can track anything you do on any website in their in-app browser

1258 points by the_mitsuhiko 4y ago

BonoboIO 4y ago
The sheer number of traffic and data … if one company knows if we are heading into a recession it’s Facebook!
vivegi 4y ago
Would Content Security Policy (CSP) offer some mitigation against this? https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
janaagaard 4y ago
Would it be possible for Apple to create an acceptable user experience if they only allowed opening up links in Safari instead of embedded web frame?
senttoschool 4y ago
No wonder. I recently opened a link on Instagram and the website's responsive elements were completely broken. Then I opened the link in Safari and it worked fine. Does this script injection break Apple's ToS? I thought Apple required Safari/Webkit for all in-app browsers? Zuckerberg has no shame. PS. I hate in-app browsers. They don't sync with my main browser states such as authenticated sessions.
- yieldcrv 4y ago
  > Does this break Apple's ToS? I thought Apple required Safari/Webkit for all in-app browsers? Doesn't apply to special companies.
  - runevault 4y ago
    Apple has been fine doing things that hurt FB, see not giving them special privileges' around the Ad tracking permission changes that were added to iOS.
- ffpip 4y ago
  > Does this break Apple's ToS? I thought Apple required Safari/Webkit for all in-app browsers? They are still using Safari/Webkit, but just injecting a script into every page.
  - pantulis 4y ago
    Is there a legitimate use case that could explain why Apple is allowing this?
- navanchauhan 4y ago
  It probably is still running Webkit underneath with some additional JavaScript to track everything
  - noduerme 4y ago
    It would have to be. Apple's main bugbear seems to be anyone embedding Chrome or Firefox on iOS.
- kube-system 4y ago
  > PS. I hate in-app browsers. They don't sync with my main browser states such as authenticated sessions. Seems like that's probably a good thing :)
- samstave 4y ago
  >They don't sync with my main browser states such as authenticated sessions. Under what circums do you want this?
  - anamexis 4y ago
    All the time. For example: open a link in Gmail, forget that I am in the in-app browser, and log into a service.
  - senttoschool 4y ago
    > Under what circums do you want this? Click on "Sign In/Up with Google". Opens in app browser. Not logged in even though I'm with Safari. Type email. Type password. Get password wrong. Type password again. Get text/email with 2FA code. Every single time. Or Gmail app. Click link. Open in-app browser. Not logged in.
    - sneak 4y ago
      You shouldn't be typing passwords in 2022, get a password manager.
      - senttoschool 4y ago
        Not paying a subscription for a password manager. And don't want a single point of failure for all my accounts.
        sneak 4y ago
        Self-host vaultwarden, it's free, and it syncs to all your devices so you have a bunch of backups.
    - samstave 4y ago
      I am not a fan of the "Password Fabric" - if you are, you are not my friend...
  - upbeat_general 4y ago
- deleted 4y ago
  [deleted]
- mh- 4y ago
  > They don't sync with my main browser states such as authenticated sessions. And this is exactly why Apple gives them their own cookie jar. The alternative would be [more of] a security nightmare.
pphysch 4y ago
Isn't this the main reason why social media pushes their apps over their (once) perfectly functional websites? Better analytics = better product*. * for the true customers, i.e. marketing & communication firms, governments, etc.
- l33t2328 4y ago
  Why do you say “true customers”? Is anyone under the impression that they are a customer of a service they don’t pay for? People would readily identify as a “Twitter user” instead of a “Twitter customer”
  - happymellon 4y ago
    I would agree that a lot of people who use these things do not consider themselves to be a product to be sold to marketing firms.
  - woodruffw 4y ago
    > Is anyone under the impression that they are a customer of a service they don’t pay for? Maybe not on a technical forum like this, but I think the distinction between a "customer" and a "user" is sufficiently fuzzy among non-technical people.
  - JohnFen 4y ago
    These days, you can expect companies to do the exact same thing even if you do pay for the service.
  - rightbyte 4y ago
    E.g. Samsung spies on paying users of their TVs.
cloudking 4y ago
They can also track anything you do outside their browser, on a website with their tracking pixel.
- croes 4y ago
  You can install blockers in your browser but not in in-app browsers
  - stephenson 4y ago
    This is why I have pi-hole on my network (https://github.com/pi-hole https://github.com/pi-hole)
- hashishen 4y ago
  Firefox has built in tracking protection to prevent this iirc
shadowgovt 4y ago
Interesting. This is a risk vector I never considered regarding allowing third parties to provide a browser on a mobile device.
zahma 4y ago
Any reason why Google Maps wouldn’t* use the same in-app tracking? Edit: meant why Google wouldn’t do this. I guess what I really mean, is what are the chances they don’t do this?
- smitty1110 4y ago
  Yeah, tracking your behavior. If you searched for a bar, did you look at other bars? Parking? What other things did you look at? All of this could potentially be used for segmentation.
- rawling 4y ago
  Yes, Google Maps probably tracks your usage of Google Maps. But when you click through to a location's website, it doesn't open that in a local webview and track how you use their website. Whether Chrome tracks how you use it...
tiku 4y ago
I still remember the LinkedIn app ripping all my contacts, so no apps for me. I just use the sites.
- testfoobar 4y ago
  Quite a few apps from the early mobile days did this.
- PenguinCoder 4y ago
  > use the sites. Which are increasingly user hostile, if not down right impossible to view on mobile. Go try using Reddit or Twitter on your Mobile browser.
  - rmnclmnt 4y ago
    My solution to this for past year: only use the laptop for most things. No more distractions in the pocket, feels pretty good!
  - kurupt213 4y ago
    That makes it real easy, actually. No Reddit or Twitter
    - jeffwask 4y ago
      RIF is a good alternative Reddit phone client. https://play.google.com/store/apps/details?id=com.andrewshu.android.reddit&hl=en_US&gl=US https://play.google.com/store/apps/details?id=com.andrewshu.... For those of us who can't go to the bathroom without reddit.
  - prmoustache 4y ago
    Actually twitter is fine on a mobile browser provided you use an account. What I miss is the multi-container extension on fennec/firefox mobile. I keep using those sites in incognito mode but that mean I can only use one at a time.
    - 4y ago
joshu 4y ago
i don't understand why apple allows in-app browsers.
- nkozyra 4y ago
  You mean custom ones, right? WebViews are incredibly useful, but it definitely seems like implementing your own browser gives people a false sense of security, like they've been sandboxed when they haven't. What would be nice here is a permission requirement if you're injecting code into a browser view.
  - joshu 4y ago
    webviews for clicking arbitrary links in apps like instagram or gmail are absurdly restrictive. i lose my context, cookies, and regular tools (bookmarks are gone, sharing often overridden, etc)
    - jhgg 4y ago
      This is why https://developer.apple.com/documentation/safariservices/sfsafariviewcontroller https://developer.apple.com/documentation/safariservices/sfs... exists and why the blog post advocates for using it.
      - wonderbore 4y ago
        That was a great update, but still not a true browser. No tabs, no bookmarks. Why should the website be restricted to one tab? Just open Safari and be done with it.
        thirdsun 4y ago
        If you want a true browser there's always the option to move the current page from the in-app Safari View to the full browser. In many cases I'd like to stay within the app. Those in-app Safari Webviews allows that. And if it is a website I'd like to browse in my usual, more permanent browsing evironment I always have th eoption to do so. This two step approach is more useful to me than always opening links in the browser.
sergiotapia 4y ago
Sick company. Period.
- deleted 4y ago
  [deleted]
AlexandrB 4y ago
Awful stuff. I shudder to think what a Meta-run App Store or "metaverse" would look like from a tracking perspective. Meanwhile, the "dumb fucks" quote[1] remains evergreen. [1] https://www.businessinsider.com/well-these-new-zuckerberg-ims-wont-help-facebooks-privacy-problems-2010-5?utm_source=reddit.com https://www.businessinsider.com/well-these-new-zuckerberg-im...
kurupt213 4y ago
Never go in app
nemothekid 4y ago
I also noticed TikTok does this as well; at the very least they are snooping inside their in-app browser to prevent you from visiting adult sites.
- Flimm 4y ago
  The article isn't complaining about in-app browsers per se, but that Instagram implements a special version of an in-app browser that injects Javascript code to track user behaviour. If you have noticed TikTok doing the same thing, please publish a blog post about it, and I expect it would get attention here on Hacker News, at least.
  - notpushkin 4y ago
    I would be really surprised if TikTok doesn't do this.
ledauphin 4y ago
I can't imagine why anyone would expect otherwise. If you're still 'inside' an application, why wouldn't that app be able to track everything you do? To completely hijack the discussion here, I believe that Apple is actually one of the strongest forces for anti-privacy in the world, because of their long-term, successful push for the convention of app > website (not fully supporting PWAs, disallowing web push, etc). A website may spy on you, but it can only do so in ways constrained by the browser, which has to serve many "masters". Mobile apps are completely unconstrained in their spying, and in-app browsers are just the logical extension of that pattern. Thanks largely to Apple, we've conditioned ourselves to expecting that you can't have good mobile UX without a mobile-native application, and it's hard to imagine ever escaping back into the relatively open web now that we're this far down this path. Most people will never question the privacy implications of installing the Facebook app, and most of Apple's privacy-directed efforts on iOS are basically playing walled-garden whack-a-mole on problems that are better solved at a societal level with web browser standards. Yes, it's quite likely that I'm scapegoating here, but it's the way I see it.
- ezfe 4y ago
  Apps that use Safari View Controller cannot view the page - of course Facebook doesn't use SVC for this reason. While you're right that the Facebook/Instagram app can spy on links opened within the app, it can't plant cookies in your web browser - so those go both ways.
  - jefftk 4y ago
    I thought Facebook/Instagram used a WebView for their in-app browser on both iOS and Android? Which means they can do anything they want, including exfiltrate your browsing.
    - ezfe 4y ago
      I meant "of course Facebook doesn't [use Safari View Controller]". WebView ≠ Safari View Controller. Safari View Controller keeps the users cookies from Safari and prevents this behavior. For most apps, keeping users logged in without leaving the app is preferred, so they give up the ability to inspect the contents of the page.
dilDDoS 4y ago
I generally don't see any appeal to in-app browsers in the first place. They often have extremely broken navigation controls (i.e. attempting to swipe back to a previous page usually just returns back to the app), block the ability to navigate to a specific URL, content blockers don't work, don't allow opening "smart links" that would typically open in another app if opened from a normal browser, etc. From what I'm gathering from this article, it sounds like in-app browsing allows apps to give you all of the "benefits" of being tracked (for their benefit only), with none of the (actual) benefits of using a real browser.
- samtheprogram 4y ago
  Ironically the whole point of it originally was sandboxing, and it’s true at least on iOS. Thus, you won’t be logged into the same sites within an in-app browser, and clicking a link from within an app (whether it appears to be an link or not) can’t automatically connect you to cookies and any other tracking from your actual browser.
  - tjoff 4y ago
    On android I have firefox-focus as my default browser (and disable any in-app browsing) for that same purpose.
    - flanbiscuit 4y ago
      Also available in Firefox for Android (not just FF Focus) Settings > Advanced > "Open links in apps" https://support.mozilla.org/en-US/kb/set-firefox-android-open-links-native-apps https://support.mozilla.org/en-US/kb/set-firefox-android-ope...
      - tjoff 4y ago
        The point with firefox focus is that the whole browser is in private mode. And even another browser, so no shared sessions or anything with your normal browser or precious interactions/sessions. Not sure if open-links-in-apps is comparable to that, never tried it (I rather prefer multitasking than doing it from within the app anyway).
jeffwask 4y ago
Awful but not suprising. Their apps are effectively spyware at this point.
- pid_0 4y ago
EGreg 4y ago
I once wrote an email to Steve Jobs, saying that operating systems like MacOS and iOS should have a secret phrase or icon that they show to you whenever they show a system-level security dialog. (And of course implement the same restrictions on screenshots of that dialog as they do for movies.) Because otherwise, an app can totally fake the interface of a security dialog. The only way you know, these days, is that password managers and cookie jars work with the "approved" sites, but they can simply show you a site that doesn't require those, and then fool you into entering your passwords! Steve never replied to me. And Apple never implemented it.
- Mordisquitos 4y ago
  Fun fact, the Spanish word for password, "contraseña", originally implied this behaviour as "seña" —> "contraseña" ("sign" —> "countersign").
asadlionpk 4y ago
I hope Apple doesn't disable JS injection in WKWebViews in response to this. JS injection is the (only?) way to call native Swift methods from JS ie. bridging. I am not sure what the solution here is. Maybe only allow injection to sites you control (via apple association file).
- nofunsir 4y ago
  I hope they do.
- throwaway290 4y ago
  Wait, websites can call native Swift methods from JS?
  - Linkd 4y ago
    Certainly. See https://developer.apple.com/documentation/webkit/wkscriptmessagehandler https://developer.apple.com/documentation/webkit/wkscriptmes...
  - _rend 4y ago
    Only intentionally, via setup from a hosting app. If an app uses a WKWebView to display web content, it can use WKUserContentController[1] to inject scripts and additional content into the page dynamically, and can inject functions into JS[2] which will trigger native callback handlers when called. If your app uses the JavaScriptCore[3] framework to run JS in a VM in-process directly, you have even more options for interfacing between JS and native code. Note that this has to be explicitly hooked up by the app (i.e., none of this applies within, say, Safari). [1]: https://developer.apple.com/documentation/webkit/wkusercontentcontroller https://developer.apple.com/documentation/webkit/wkuserconte... [2]: https://developer.apple.com/documentation/webkit/wkusercontentcontroller/1537172-add https://developer.apple.com/documentation/webkit/wkuserconte... [3]: https://developer.apple.com/documentation/javascriptcore https://developer.apple.com/documentation/javascriptcore
  - Spivak 4y ago
    Short answer: yes With the appropriate libraries you can use JS to call Swift and Obj C code. Long answer: no All it really means is that the JS and Swift/Obj C can pass data between each other and the library is set up to parse that data and call the appropriate code. It's just an automatic RPC.
greenie_beans 4y ago
i always just assumed this and used the app accordingly. but glad there is some proof.
andix 4y ago
It would be interesting if this violates rights of the website owner the user is visiting. I known that embedding content of other websites into your own via an iframe can be a copyright violation. And what Meta does here is more or less like an iframe.
- AtNightWeCode 4y ago
  I believe so. Copyright and TOS of the sites. Copyright also in the sense that content have been changed. This should be on pair with banner swap techs.
- upupandup 4y ago
  It isn't. By that logic any browser is liable for violating ToS of websites, which btw isn't the law and you are not obligated to follow anyhow. This of course is a different case for corporations with a dedicated legal team.
  - andix 4y ago
    First Instagram is not a browser. And second the browser manufacturer (usually) doesn’t make any money by tracking their users. They provide them with a tool, a browser. There is the browser Brave, that replaces ads on websites (and makes some profit with that), and there are some serious legal issues coming with that.
    - avalys 4y ago
      Seems like Instagram _is_ a browser. The right you seem to be claiming is “you can’t render my website in your app if I don’t like your app”, and that’s not how it works.
      - andix 4y ago
        So why are iframes then not allowed by some legislations? Because an iframe is also "just a browser".
    - 4y ago
notatoad 4y ago
>I’ve disclosed this issue with Meta through their Bug Bounty Program lol. and this is why companies can be hesitant to run bug bounty programs. it's not a place to complain about things you don't like. Meta/instagram has made a design decision here. just because you don't like it, doesn't mean it's a vulnerability.
- lrvick 4y ago
  Remember this is the same company that just gave police DMs that aided in an abortion investigation. If those had been end to end encrypted that risk would not have existed, but they made a business decision to leave the application vulnerable to spying for profit reasons. That is a vulnerability, in the same way we call it a vulnerability when an entity man-in-the-middles a browser to spy on people. Personal user browsing or communications leaking in plain text to private companies without explicit and obvious user consent puts users at risk, and is a vulnerability. It just so happens to be one arising from malicious profit seeking behavior that happens to be the status quo. Not having https was once the status quo, and a boon for corporate spying, but we call that a vulnerability now because the abuses became too big too ignore.
  - 202206241203 4y ago
    Yes, but people love that, otherwise e.g. freemium and ad-driven games would not exist. Consumers have a payment-avoiding behaviour as a status quo.
    - lrvick 4y ago
      This comes across as victim blaming. Users are given the choice to accept risks that are buried on page 7 of privacy policies only a lawyer could understand the tricks in. Services knowingly endangering unknowing users for money should be like cigarettes and be forced to say on the signup page in big bold text they can and will sell user data to anyone, including law enforcement. Users largely think free services are like public libraries and do not default to expecting they are being exploited for money. Element, Wikipedia, and duckduckgo exist for free without selling user data so it is not a given that exploitation is always present in free services.
benbristow 4y ago
One thing I've noticed is that content-blockers/adblock don't seem to work within the Facebook/Instagram etc. in-app browsers so I usually end up jumping out of them anyway.
- vuln 4y ago
  Yup same. I jump out as soon as it attempts to load and I have the ability.
- saagarjha 4y ago
  Content blockers only work in Safari and SFSafariViewController.
- thallium205 4y ago
  The worst is when the link is YouTube and I have to watch an ad even though I pay for YouTube Premium but because it launched in an app browser I'm not logged in.
scraplab 4y ago
As a provider is it possible to defend against this with a Content Security Policy or does this mechanism override the site’s CSP?
- robocat 4y ago
  MDN docs for Content Security Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP (for anyone unfamiliar with that browser feature that should in theory disallow injection for websites you control).
- the_mitsuhiko 4y ago
  External sources yes, preventing an app to inject inline HTML and JavaScript is tricky.
  - ezekg 4y ago
    You can block all inline scripts via CSP.
    - the_mitsuhiko 4y ago
      That’s why I said tricky and not impossible.
- xfitm3 4y ago
  Strides have been made in web security, check out the permissions policy[0] along with COOP and COEP[1]. [0] https://www.w3.org/TR/permissions-policy-1/ https://www.w3.org/TR/permissions-policy-1/ [1] https://scotthelme.co.uk/enabling-coop-and-coep-reports-on-report-uri/ https://scotthelme.co.uk/enabling-coop-and-coep-reports-on-r...
- RKearney 4y ago
  Not only would CSP block it, but this type of behavior only strengthens Apple's decision to not allow third party rendering engines. Could you imagine the privacy nightmare that would ensue if Facebook could release a browser that bypassed any and all safeguards implemented by site operators?
AtNightWeCode 4y ago
I believe this is not legal. It is a grey area for users to do things like this but for a browser to change the actual contents is illegal on most sites. Or at least, there is no general way for a browser to validate if it is legal or not.
- AtNightWeCode 4y ago
  HN should really get rid of the down votes... Please explain why you think it is legal for a proxy to inject custom scripts. I am sure our TOS states that this is not allowed. Also, I think it basically is a copyright infringement.
elorant 4y ago
That's the definition of a malware.
sneak 4y ago
If these platforms do things that are abusive and invasive, the solution is not to complain about it, the solution is to stop donating content to them for free and delete your account so they aren't attractive to more users. Continuing to enrich them, even by your reachability via their DM messengers, makes them more attractive to your friends and family. Delete your Facebook and Instagram accounts. Stop giving them positive feedback (via continued usage and content donations) after they make clear choices to abuse you.
nodejsthrowaway 4y ago
Is this different from my android experience where I open a link from an app and it opens my default browser, Firefox, but kind-of within the app, but allows me to instantly switch over to the Firefox app instead using a drop-down menu option?
- Flimm 4y ago
  iOS provides a way of showing a browser that looks like it's within the app from which it is launched. This is not what Instagram is doing. Instagram is doing something different from what other apps like Telegram do, according to the article: > Comparing this to what happens when using a normal browser, or in this case, Telegram, which uses the recommended SFSafariViewController: > As you can see, a regular browser, or SFSafariViewController doesn’t run any JS code. SFSafariViewController is a great way for app developers to show third party web content to the user, without them leaving your app, while still preserving the privacy and comfort for the user.
- izacus 4y ago
  Android has two ways of doing that - Chrome Custom Tabs which are secured against this (iirc) and WebView which isnt. Custom Tabs always have a title bar and a small writing "Powered by <browser>" at the end of the menu.
cdransf 4y ago
If you insist on running Meta's spyware on your devices you can also use a service like nextDNS to block trackers at the device DNS level: https://apple.nextdns.io https://apple.nextdns.io
kart23 4y ago
surprised this is at the top of HN. isn’t it obvious that every app does this? tiktok, snapchat, even linkedin all open links in their built-in browser and can track what you’re doing. click open in safari if you’re doing anything more than visiting a single page.
- plif 4y ago
  Yep, this is a feature, not just for tracking but also containment when navigating to external links. Big reason why all of those apps and others aggressively push users from web to mobile.
- SnowHill9902 4y ago
  It’s not obvious but it is reasonable.
- madeofpalk 4y ago
  It's not surprising, but it's not obvious.
- InCityDreams 4y ago
  >isn’t it obvious that every app does this? Not if you never have/ don't use them.
- MrStonedOne 4y ago
- joshstrange 4y ago
  I was/am a little surprised since I thought everyone had to use SFSafariViewController for stuff like this (which doesn't allow the developer to reach in). I "eject" out to Safari almost always when I get in in-app-browser (if only for cookies/logged in status) so this doesn't affect me much but it did come as a surprise.
- somerando7 4y ago
  To me it's not obvious. I wouldn't think that an app can inject JS into a website because I'm using a web-browser from their app.
cloudyporpoise 4y ago
The battle for control continues. I started noticing this personally when using social media and took note of the fact that the browsing was still being done within the app when clicking on an external link. The war on control of data continues on.
- thallium205 4y ago
  Facebook used to have a feature in their settings where you could opt out of their in app browser. No longer.
wonderbore 4y ago
Please tell every newspaper to publish this so Apple puts a stop to this. I have no idea why they allow this. All apps should use Safari unless they’re a browser and this rated “18+”
- TaylorAlexander 4y ago
  Well I like when browsing reddit that when I open links they are sandboxed. The in-app browser in that case has an easy button to open to get to my normal safari if I want to.
  - wonderbore 4y ago
    I’d much rather seen a system-wide “container” implementation a-la-Firefox instead. Safari is pretty good at this but not as good as Firefox. I really want my real-life accounts be segregated from the rest of the internet. Reddit should never be able to know what other sites I use.
    - TaylorAlexander 4y ago
      Under the implementation in the Reddit app I use (BaconReader), links open in a webview that is an isolated instance of WebKit or whatever the safari engine is called. So already Reddit does not know what other sites I use. Reddit does not have access to the content of my normal safari instance.
dazbradbury 4y ago
Websites need cookie notices, but apps can track your full web usage (albeit within the in-app browser) without any such notice or opt in? Doesn't seem like this would be legal. Anyone know how this could be compliant in the EU? It's also frustrating that on an android device you can't simply disable in-app browsers globally.
- Nextgrid 4y ago
  GDPR enforcement is significantly lacking. There's basically zero ways this is compliant unless it's opt-in (but who in their right mind would opt-in?) but the regulators aren't interested in standing up to these nasty companies.
- flipbrad 4y ago
  The EU+UK e-privacy "cookie" rule applies to apps in the same way as anything else that's sending/receiving data over a public network (e.g. the Internet): all storage of information to, or reading of information from, the end-user device requires their free, informed and specific consent, unless it's a technical necessity for the service they requested, or certain limited (technical) purposes like load balancing. How strictly this is enforced by regulators has waxed and waned over time and from one country to another. Civil litigants, however, have had pretty good results in the courts (or just threatening litigation) - e.g. the Lloyd and Vidal-Hall cases against Google in the UK
- fleddr 4y ago
  I'm not familiar with the Instagram signup flow but it may very well be that the user did opt-in at one point. The opt-in would of course only be valid if there's also a clear "reject" option.
guelo 4y ago
Apps in general are awful for users. I do all my mobile social media browsing on the web where I have much more control over things like copying text, saving images, zooming, adblockers, privacy tools, etc.
graham1776 4y ago
I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to all the "apparent" unsafe sites, there are still ways to access the unfiltered internet inside of these safe apps. How? Usually buried in App Settings. Almost all apps use some instance of an in-app browser to (lazily) reference thier privacy policies, EULAs, or TOCs. A buried link leads to a homepage, leads to an instagram link, leads to an unfiltered internet. Yes they are long, inefficient paths to reach the internet, but curious (or motivated) individuals or children will use almost any app to reach the internet. Even boring apps like MS Teams or adding a Gmail account to iOS mail uses a secret in-app browser. This obviously presents a problem: should developers restrict any and all app access to in-app browsers, or leave policing to individuals/parents? An easy approach is to disable the in-app browser functionality in iOs, but obviously with grave cost to developers. At the same time, at what cost is in-app browser functionality being implemented.
- davet91 4y ago
  The in-app browsers could use a domain whitelist if parental controls are turned on.
  - graham1776 4y ago
    That could be an "easy" fix where you could disable use of in-app browsers through Screen Time options.
  - yowzadave 4y ago
    Shouldn't an in-app browser whose sole purpose is to read an app EULA/TOC/etc. always employ a domain whitelist, regardless of parental controls?
  - adaktix 4y ago
    It shouldn't be a parental controls thing for IG, it just needs to be made so when you're using an in-app browser, you're using it for one reason, whatever site you clicked on. Leaving the domain ends the process or opens in another browser.
stjohnswarts 4y ago
isn't this true for all in-app browsers?
ma_arkus 4y ago
Meta (Facebook, Instagram, Whatsapp) is the sneakiest, impertinent and most evil company of all them all. Much worse than the tracking and spying is how Meta does everything to make people addicted to their slot-machine like services and thereby destroying their mental health. Especially harmful for kids. The world would be a much better place without it.
iamjk 4y ago
Isn't this... what everyone (that uses in-app browsers) does? I just assumed that's a big reason why one would use in-app over sending a person to their native environment, which is decidedly a better browsing experience.
- yreg 4y ago
  I think that in times when user just quickly checks some website the better UX is to stay in the app, so there would be legitimate use cases. e.g. Apollo by iamthatis here on hn does this and I very much doubt he is doing it for tracking reasons.
  - account42 4y ago
    - yreg 4y ago
      I believe it is. Don't forget to go write your helpful 'No.' here as well. https://news.ycombinator.com/item?id=32423517 https://news.ycombinator.com/item?id=32423517
mikewhy 4y ago
If an app uses the non-OS supplied web view I just assume they're doing nefarious things. Coincidentally the only apps I have that don't use the OS supplied web view are from Meta.
nelblu 4y ago
I have always hated inapp browsers. I am a degoogled android user, and I despise any app that defaults browsing to inapp browser. If you are a developer who is defaulting to inapp browser, please stop doing it. (Biggest reason I hate inapp browsing is my ad-blocker and custom ublock origin scripts don't work correctly.)
benguild 4y ago
Obviously! That’s the whole reason they don’t just use the Safari modal
joshstrange 4y ago
I was super confused by this since to the best of my knowledge SFSafariViewController blocks anything like this, you, as a developer, cannot inject anything or peak into the view it creates. Then I got to the bottom and realized I was correct, but FB/Meta/IG/etc aren't using SFSafariViewController and instead using the older ways to embed a web view. Honestly I thought all other methods had been deprecated and had no idea apps could still make use of the less secure (for the user) options. Trust me, as a developer I've wanted to reach inside a SFSafariViewController many times to make my life easier but in the end I've just grumbled and assumed it's not possible and worked around it. I wish there was a privacy-safe way to get the best of both worlds but due to bad actors I doubt that will be possible. I need to look more into App-bound domains but I don't think even that will give me what I really wish for (a way for the page loaded in SFSafariViewController to tell my app something). Something like postMessage support for SFSafariViewController would be amazing and be safe privacy-wise I think since the contained page would need to support sending/receiving messages instead of just having code injected against their will.
- koenvdb 4y ago
  At our company we use Cordova for all our apps, which means we have to use WKWebView in order to render our application. As does ever Cordova app.
- raxxorraxor 4y ago
  But the solution isn't to enforce a specific browser or way to access web content. The solution is to educate users about the toxic software landscape on smartphones and the security threats of using apps. Ironically these supposedly checked apps behave vastly worse than the vast majority of software you can just install on a less locked down system. Because there the better alternatives mostly win.
- YourGrace 4y ago
  Yes, developers are able to leverage WKWebview on iOS and a Webview on Android. One thing about both webviews is that there are callbacks with these implementations that developers can choose to open a link in the embed webview or not. It might be useful for privacy/security for Apple/Android to force developers to allow-list a domain (like iOS's Associated Domains) or such that an embedded webview can load (besides local html and files). It might be something in addition to the developer's callback. iOS WKWebview: https://developer.apple.com/documentation/webkit/wkwebview https://developer.apple.com/documentation/webkit/wkwebview Android Webview: https://developer.android.com/guide/webapps/webview https://developer.android.com/guide/webapps/webview Associated Domains: https://developer.apple.com/documentation/Xcode/supporting-associated-domains?language=objc https://developer.apple.com/documentation/Xcode/supporting-a...
blueagle7 4y ago
Does anyone know if something like Hyperweb would affect the tracking in this?
rdtwo 4y ago
Can you use an in-app browser to host a light weight proxy server? Thereby allowing a 3rd party to access anything behind the firewall as local traffic or pretend to be the machine.
hnburnsy 4y ago
I'm confused I thought Apple only allowed web browsing via Safari... "2.5.6 Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript." If apps can use their own in app browser, why can't say Brave for example, create an app that does very little, except it browses the web with its own in app browser?
- superjan 4y ago
  This just forbids developers to write their own browser engine. It is OK to use the iOs provided webbrowser as a control in your app.
grishka 4y ago
Ah so that's why they insist so much on opening every single link in their crappy in-app browser. I decompiled and patched Instagram for Android, and I did try, among other things, to bypass that browser (and gave up because my approach somehow mysteriously broke navigation in the app), but the thought that they're using it to track you has never once crossed my mind.
nmeofthestate 4y ago
Of course. That's the point of in-app browsers right?
hollowturtle 4y ago
I’m not surprised and it’s really annoying apps still use in-app browsers. I remember even Telegram had that at one point, with link opening only on in-app browser(at least on iOS). But what really annoys me is that most of the users, e.g. my girlfriend, have NO IDEA about the difference, it’s just a browsing window, no matter in-app, which engine, with which privacy feature. Perhaps os vendors should show more obvious UI, and UX wise, tell you you’re leaving a safe browsing experience?
- makoto12 4y ago
  in-app browsers are a much better UX imo, solution is to make them safe, not get rid of them, as they solve a real ux use case
  - xigoi 4y ago
    Android has “Chrome custom tabs” (terrible name, they don't have to be Chrome) which behave like an in-app browser, but use an actual browser. I assume the app can't spy on those?
  - kevincox 4y ago
    How is the UX better? It is just a browser window with half of the features. I turn it off in every app I can and miss the old version of Firefox that had the option to disable them altogether.
    - makoto12 4y ago
      it's not the browser itself, it's the experience of staying in app when clicking a link. for example when going through a paygate that redirects to a browser. i don't want to leave the app, then come back in manually. with an in app browser it works seamlessly.
      - kevincox 4y ago
        What does "in app" do differently? On Android the only thing I can think of that is different is that if I open the app switcher the tab is in a different app. But I think I prefer that because if I click around a bit I can switch back to the app that spawned the tab directly instead if hitting back a load of times.
georgex7 4y ago
Another reason why we hate Zuck: https://backtohumanity.substack.com/p/why-people-hate-zuck https://backtohumanity.substack.com/p/why-people-hate-zuck
mtlmtlmtlmtl 4y ago
There is no reason for in-app browsers to exist besides tracking really, so this isn't all that surprising. The only effect of removing them entirely would be that stuff just worked better in general.
bacan 4y ago
In-App browsers have always been a security nightmare. Similar issues exist with Electron apps as well. But developers continue to use them as HTML + CSS + JS is the easiest way to develop a graphical dynamic UI, for a newbie. Many schools & colleges even teach basic HTML, CSS & JS, so the barrier to entry is very low. I am not sure what a good solution here would be, but maybe we could start by limiting access. Or another way could be to have some way to convert the rendered UI to compiled binary code
- xfitm3 4y ago
  Good call out on Electron apps, I try to avoid Electron as much as possible. I use Slack's web interface for example. I never made the connection until you brought it up, but yes, Electron apps are just like using Webkit on iOS. Abstracting UI/UX to a browser engine which has identical security pitfalls to a browser but with far less control and inspection capability.
riazrizvi 4y ago
Only Instagram? Every app maker who makes an in app browser can see what you do, that’s the point of embedding it. And why not? You arrive there because of a link in the container app you clicked on. They want to see what you do with the link they gave you. Otherwise only Google/Apple can see what you do with it. Someone can see what you do with the link no matter what.
- altairprime 4y ago
  Not necessarily. If they’re using a WKWebView, they can’t see what you’re doing, which is why Safari Autofill remains enabled in some but not all app-embedded web views.
  - manmal 4y ago
    This is not correct. WKWebView can be made to report back clicks and URL loads, inject JS etc. Eg here is the doc for the navigation delegate: https://developer.apple.com/documentation/webkit/wknavigationdelegate https://developer.apple.com/documentation/webkit/wknavigatio...
  - faizmokhtar 4y ago
    Only SFSafariViewController prevents that. Devs still can inject javascript through WKWebView.
    - altairprime 4y ago
      Thanks for the correction; I swapped the two in my head and you’re right.
- Tepix 4y ago
  The problem is that users cannot tell if they are being spied upon or not as long as they use in-app browsers. Avoid them! Go web apps instead of native apps for better privacy in general. Regardless, i don't consider it to be acceptable behaviour by Instagram to inject their tracking into all web pages i access through their app just because they can.
- 4y ago
spoonjim 4y ago
Every app that uses an in-app browser (which is most of them) can do this. This is a clickbait headline that relies on "Blue Company Bad" sentiments.
- bhelkey 4y ago
  > The [iOS] Instagram app injects their tracking code into every website shown, including when clicking on ads, enabling them monitor all user interactions The allegation isn't that Instagram can do this but that they are.
karek 4y ago
Why is this legal?
smm11 4y ago
I already fixed it, by not using Instagram.
chadlavi 4y ago
It's really concerning that everyone treats their children like prisoners. Your kids are gonna find a way to look at what they want anyway, why make it MORE appealing to them by making it verboten? Are you protecting them or are you controlling them?
- twodave 4y ago
  Some kids (and adults) literally aren’t capable of impulse control. It’s actually nice to be able to hand that control over to somebody else in some cases. And, as a parent if I know my child struggles with this it would be negligent of me to let them harm themselves knowing they can’t stop themselves. I have four children and if there is any generalization about raising kids that I have learned it is that each child has different needs.
deleted 4y ago
[deleted]
dzikimarian 4y ago
I'm surprised that so many people write "yeah, any in-app browser can do that - nothing to see here". Anyone can potentially steal your wallet, so we shouldn't point out when someone actually does? Especially when there's hard evidence in article?
- MomoXenosaga 4y ago
  Every app and or website steals your wallet and when you point this out to people in tech who code this shit they respond with "just following orders". Installed system wide ad blockers ages ago and got on with my life.
eis 4y ago
They not only track very invasively what you are doing but they create real problems for websites because certain features wont work anymore. Be it due to them disabling them or third party services having to block their usage because of the huge privacy and data safety issue. Simple example: try to use "Login with Google" from within one of those in-app browsers and you will notice Google had to actively detect them and block the attempt because otherwise the app could spy on the login credentials without anyone noticing. Instagram, Twitter, Facebook Messenger, TikTok.... the list goes on and on. I am very confident that these companies are breaking GDPR laws left and right on an absolutely massive scale. They are spyware at this point.
- klabb3 4y ago
  I'm with you. If you're navigating to a website, you should open the web browser. The app shouldn't monitor or inject crap when I'm going to an unaffiliated site. The worst offenders are the ones that force you to enter credentials for a 3p account with an in-app browser. That said, it's a huge UX failure that navigating between the web and an app is so broken. That doesn't mean that it's motivated to break the fundamental models of the web. Long term it does much more harm than good. How do you teach non-technical users good practices if developers circumvent these barriers anyway? "Trust us, we won't steal your Google account" is not exactly reassuring, but ok say that you trust a reputable app to do that. What happens when the user normalizes this behavior and a less reputable app does the same thing? Obviously many users will have no idea of the risk.
nxtbl 4y ago
Open in [X] Firefox Focus and it forgets everything when you close it.
solarkraft 4y ago
No shit! Instagram tracks what I do in the Instagram app!
- eis 4y ago
  You get a link inside Instagram to some website that does not belong to Instagram. It is none of Instagrams business what you do on that website. People do not even realise they are still inside Instagram while logging into their bank account and Instagram keeping a log of some of their activity inside that bank website. It's insane.
captaincrunch 4y ago
I generally assume that if I am using a browser IN ANOTHER APP, its tracking it - or could. Not hard to do
deleted 4y ago
[deleted]
echobear 4y ago
glad I just deleted instagram lol
lawgimenez 4y ago
The only way out of this if Google and Apple can remove Javascript support in both WebView and WKWebView.
izzytcp 4y ago
Common people, this is not news. At least for Hacker News.
dang 4y ago
Related ongoing thread: Let websites framebust out of native apps - https://news.ycombinator.com/item?id=32418679 https://news.ycombinator.com/item?id=32418679 - Aug 2022 (37 comments)
odd_chimera_out 4y ago
I had assumed this with all browsers, otherwise why are they free? Ive been told by a very destinguished person (Judge) that "if its too good to be true then its not (i.e. something expensive is rediculously cheap, its obviously stolen), and anyone with a highschool education +, could determine that." why would a judge say that if its not true = must be true when thats the way the law sees it, then its kind of hard to argue. "nothing in life is free"
smrtinsert 4y ago
Is there evidence Instagram takes advantage of this? Shameful if so.
mbrochh 4y ago
There is nothing of real value on Instagram. Just delete your account and never look back.
- zsims 4y ago
  Um excuse me, how will people know I had an açai bowl for lunch?
- driverdan 4y ago
- neop1x 4y ago
  My words. People are just wasting their time in these useless ad-selling services.
DarthNebo 4y ago
This is nuts, injecting code without website consent, pretty much like shady-ISP behaviour!
marsven_422 4y ago
BroadbandSurfer 4y ago
Separate yourself from big tech as much as possible and switching to only FOSS Software/Apps can be a great start for many who want more privacy. Can go way more into other ways but too tired, also most who are surprised by this just need a starting point. Btw, Apple and Mozilla are no privacy guardians out to protect you. These days they do just as bad.
larkinrichards 4y ago
> How can I protect myself? For full details scroll down to the end of the article. Summary: Whenever you open a link from Instagram (or Facebook or Messenger), make sure to click the dots in the corner to open the page in Safari instead. “How do I protect myself?” should be point number one. Does apple require that developers allow users to open these links in safari—- w/o tracking? Or do developers feel this is the only moral way they can agree to this user-hostile behavior?
ryanmercer 4y ago
I assume any app can see everything I do if I use their in-app browser just like I assume every brick and mortar store can see everything I do inside their store.
whatsthatabout 4y ago
Always thought Meta would absolutely do something creepy like this. Just ditched my app for the web app - bonus feature: No more ads (if you have a safari adblocker installed)
anonymous344 4y ago
This s*it should be illegal. Let's say Tiktok for example, it opens everything in who-knows-what-they-track webview that has even the copy to clipboard function disabled. Where is EU when you need them??
deleted 4y ago
[deleted]

1258 points by the_mitsuhiko 4y ago

The sheer number of traffic and data … if one company knows if we are heading into a recession it’s Facebook!

Would Content Security Policy (CSP) offer some mitigation against this? https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

janaagaard 4y ago

Would it be possible for Apple to create an acceptable user experience if they only allowed opening up links in Safari instead of embedded web frame?

senttoschool 4y ago

No wonder. I recently opened a link on Instagram and the website's responsive elements were completely broken. Then I opened the link in Safari and it worked fine. Does this script injection break Apple's ToS? I thought Apple required Safari/Webkit for all in-app browsers? Zuckerberg has no shame. PS. I hate in-app browsers. They don't sync with my main browser states such as authenticated sessions.

yieldcrv 4y ago
> Does this break Apple's ToS? I thought Apple required Safari/Webkit for all in-app browsers? Doesn't apply to special companies.
- runevault 4y ago
  Apple has been fine doing things that hurt FB, see not giving them special privileges' around the Ad tracking permission changes that were added to iOS.
ffpip 4y ago
> Does this break Apple's ToS? I thought Apple required Safari/Webkit for all in-app browsers? They are still using Safari/Webkit, but just injecting a script into every page.
- pantulis 4y ago
  Is there a legitimate use case that could explain why Apple is allowing this?
navanchauhan 4y ago
It probably is still running Webkit underneath with some additional JavaScript to track everything
- noduerme 4y ago
  It would have to be. Apple's main bugbear seems to be anyone embedding Chrome or Firefox on iOS.
kube-system 4y ago
> PS. I hate in-app browsers. They don't sync with my main browser states such as authenticated sessions. Seems like that's probably a good thing :)
samstave 4y ago
>They don't sync with my main browser states such as authenticated sessions. Under what circums do you want this?
- anamexis 4y ago
  All the time. For example: open a link in Gmail, forget that I am in the in-app browser, and log into a service.
- senttoschool 4y ago
  > Under what circums do you want this? Click on "Sign In/Up with Google". Opens in app browser. Not logged in even though I'm with Safari. Type email. Type password. Get password wrong. Type password again. Get text/email with 2FA code. Every single time. Or Gmail app. Click link. Open in-app browser. Not logged in.
  - sneak 4y ago
    You shouldn't be typing passwords in 2022, get a password manager.
    - senttoschool 4y ago
      Not paying a subscription for a password manager. And don't want a single point of failure for all my accounts.
      - sneak 4y ago
        Self-host vaultwarden, it's free, and it syncs to all your devices so you have a bunch of backups.
  - samstave 4y ago
    I am not a fan of the "Password Fabric" - if you are, you are not my friend...
- upbeat_general 4y ago
deleted 4y ago
[deleted]
mh- 4y ago
> They don't sync with my main browser states such as authenticated sessions. And this is exactly why Apple gives them their own cookie jar. The alternative would be [more of] a security nightmare.

pphysch 4y ago

Isn't this the main reason why social media pushes their apps over their (once) perfectly functional websites? Better analytics = better product*. * for the true customers, i.e. marketing & communication firms, governments, etc.

l33t2328 4y ago
Why do you say “true customers”? Is anyone under the impression that they are a customer of a service they don’t pay for? People would readily identify as a “Twitter user” instead of a “Twitter customer”
- happymellon 4y ago
  I would agree that a lot of people who use these things do not consider themselves to be a product to be sold to marketing firms.
- woodruffw 4y ago
  > Is anyone under the impression that they are a customer of a service they don’t pay for? Maybe not on a technical forum like this, but I think the distinction between a "customer" and a "user" is sufficiently fuzzy among non-technical people.
- JohnFen 4y ago
  These days, you can expect companies to do the exact same thing even if you do pay for the service.
- rightbyte 4y ago
  E.g. Samsung spies on paying users of their TVs.

cloudking 4y ago

They can also track anything you do outside their browser, on a website with their tracking pixel.

croes 4y ago
You can install blockers in your browser but not in in-app browsers
- stephenson 4y ago
  This is why I have pi-hole on my network (https://github.com/pi-hole https://github.com/pi-hole)
hashishen 4y ago
Firefox has built in tracking protection to prevent this iirc

shadowgovt 4y ago

Interesting. This is a risk vector I never considered regarding allowing third parties to provide a browser on a mobile device.

zahma 4y ago

Any reason why Google Maps wouldn’t* use the same in-app tracking? Edit: meant why Google wouldn’t do this. I guess what I really mean, is what are the chances they don’t do this?

smitty1110 4y ago
Yeah, tracking your behavior. If you searched for a bar, did you look at other bars? Parking? What other things did you look at? All of this could potentially be used for segmentation.
rawling 4y ago
Yes, Google Maps probably tracks your usage of Google Maps. But when you click through to a location's website, it doesn't open that in a local webview and track how you use their website. Whether Chrome tracks how you use it...

tiku 4y ago

I still remember the LinkedIn app ripping all my contacts, so no apps for me. I just use the sites.

testfoobar 4y ago
Quite a few apps from the early mobile days did this.
PenguinCoder 4y ago
> use the sites. Which are increasingly user hostile, if not down right impossible to view on mobile. Go try using Reddit or Twitter on your Mobile browser.
- rmnclmnt 4y ago
  My solution to this for past year: only use the laptop for most things. No more distractions in the pocket, feels pretty good!
- kurupt213 4y ago
  That makes it real easy, actually. No Reddit or Twitter
  - jeffwask 4y ago
    RIF is a good alternative Reddit phone client. https://play.google.com/store/apps/details?id=com.andrewshu.android.reddit&hl=en_US&gl=US https://play.google.com/store/apps/details?id=com.andrewshu.... For those of us who can't go to the bathroom without reddit.
- prmoustache 4y ago
  Actually twitter is fine on a mobile browser provided you use an account. What I miss is the multi-container extension on fennec/firefox mobile. I keep using those sites in incognito mode but that mean I can only use one at a time.
  - 4y ago

joshu 4y ago

i don't understand why apple allows in-app browsers.

nkozyra 4y ago
You mean custom ones, right? WebViews are incredibly useful, but it definitely seems like implementing your own browser gives people a false sense of security, like they've been sandboxed when they haven't. What would be nice here is a permission requirement if you're injecting code into a browser view.
- joshu 4y ago
  webviews for clicking arbitrary links in apps like instagram or gmail are absurdly restrictive. i lose my context, cookies, and regular tools (bookmarks are gone, sharing often overridden, etc)
  - jhgg 4y ago
    This is why https://developer.apple.com/documentation/safariservices/sfsafariviewcontroller https://developer.apple.com/documentation/safariservices/sfs... exists and why the blog post advocates for using it.
    - wonderbore 4y ago
      That was a great update, but still not a true browser. No tabs, no bookmarks. Why should the website be restricted to one tab? Just open Safari and be done with it.
      - thirdsun 4y ago
        If you want a true browser there's always the option to move the current page from the in-app Safari View to the full browser. In many cases I'd like to stay within the app. Those in-app Safari Webviews allows that. And if it is a website I'd like to browse in my usual, more permanent browsing evironment I always have th eoption to do so. This two step approach is more useful to me than always opening links in the browser.

sergiotapia 4y ago

Sick company. Period.

deleted 4y ago
[deleted]

AlexandrB 4y ago

Awful stuff. I shudder to think what a Meta-run App Store or "metaverse" would look like from a tracking perspective. Meanwhile, the "dumb fucks" quote[1] remains evergreen. [1] https://www.businessinsider.com/well-these-new-zuckerberg-ims-wont-help-facebooks-privacy-problems-2010-5?utm_source=reddit.com https://www.businessinsider.com/well-these-new-zuckerberg-im...

kurupt213 4y ago

Never go in app

nemothekid 4y ago

I also noticed TikTok does this as well; at the very least they are snooping inside their in-app browser to prevent you from visiting adult sites.

Flimm 4y ago
The article isn't complaining about in-app browsers per se, but that Instagram implements a special version of an in-app browser that injects Javascript code to track user behaviour. If you have noticed TikTok doing the same thing, please publish a blog post about it, and I expect it would get attention here on Hacker News, at least.
- notpushkin 4y ago
  I would be really surprised if TikTok doesn't do this.

ledauphin 4y ago

I can't imagine why anyone would expect otherwise. If you're still 'inside' an application, why wouldn't that app be able to track everything you do? To completely hijack the discussion here, I believe that Apple is actually one of the strongest forces for anti-privacy in the world, because of their long-term, successful push for the convention of app > website (not fully supporting PWAs, disallowing web push, etc). A website may spy on you, but it can only do so in ways constrained by the browser, which has to serve many "masters". Mobile apps are completely unconstrained in their spying, and in-app browsers are just the logical extension of that pattern. Thanks largely to Apple, we've conditioned ourselves to expecting that you can't have good mobile UX without a mobile-native application, and it's hard to imagine ever escaping back into the relatively open web now that we're this far down this path. Most people will never question the privacy implications of installing the Facebook app, and most of Apple's privacy-directed efforts on iOS are basically playing walled-garden whack-a-mole on problems that are better solved at a societal level with web browser standards. Yes, it's quite likely that I'm scapegoating here, but it's the way I see it.

ezfe 4y ago
Apps that use Safari View Controller cannot view the page - of course Facebook doesn't use SVC for this reason. While you're right that the Facebook/Instagram app can spy on links opened within the app, it can't plant cookies in your web browser - so those go both ways.
- jefftk 4y ago
  I thought Facebook/Instagram used a WebView for their in-app browser on both iOS and Android? Which means they can do anything they want, including exfiltrate your browsing.
  - ezfe 4y ago
    I meant "of course Facebook doesn't [use Safari View Controller]". WebView ≠ Safari View Controller. Safari View Controller keeps the users cookies from Safari and prevents this behavior. For most apps, keeping users logged in without leaving the app is preferred, so they give up the ability to inspect the contents of the page.

dilDDoS 4y ago

I generally don't see any appeal to in-app browsers in the first place. They often have extremely broken navigation controls (i.e. attempting to swipe back to a previous page usually just returns back to the app), block the ability to navigate to a specific URL, content blockers don't work, don't allow opening "smart links" that would typically open in another app if opened from a normal browser, etc. From what I'm gathering from this article, it sounds like in-app browsing allows apps to give you all of the "benefits" of being tracked (for their benefit only), with none of the (actual) benefits of using a real browser.

samtheprogram 4y ago
Ironically the whole point of it originally was sandboxing, and it’s true at least on iOS. Thus, you won’t be logged into the same sites within an in-app browser, and clicking a link from within an app (whether it appears to be an link or not) can’t automatically connect you to cookies and any other tracking from your actual browser.
- tjoff 4y ago
  On android I have firefox-focus as my default browser (and disable any in-app browsing) for that same purpose.
  - flanbiscuit 4y ago
    Also available in Firefox for Android (not just FF Focus) Settings > Advanced > "Open links in apps" https://support.mozilla.org/en-US/kb/set-firefox-android-open-links-native-apps https://support.mozilla.org/en-US/kb/set-firefox-android-ope...
    - tjoff 4y ago
      The point with firefox focus is that the whole browser is in private mode. And even another browser, so no shared sessions or anything with your normal browser or precious interactions/sessions. Not sure if open-links-in-apps is comparable to that, never tried it (I rather prefer multitasking than doing it from within the app anyway).

jeffwask 4y ago

Awful but not suprising. Their apps are effectively spyware at this point.

pid_0 4y ago

EGreg 4y ago

I once wrote an email to Steve Jobs, saying that operating systems like MacOS and iOS should have a secret phrase or icon that they show to you whenever they show a system-level security dialog. (And of course implement the same restrictions on screenshots of that dialog as they do for movies.) Because otherwise, an app can totally fake the interface of a security dialog. The only way you know, these days, is that password managers and cookie jars work with the "approved" sites, but they can simply show you a site that doesn't require those, and then fool you into entering your passwords! Steve never replied to me. And Apple never implemented it.

Mordisquitos 4y ago
Fun fact, the Spanish word for password, "contraseña", originally implied this behaviour as "seña" —> "contraseña" ("sign" —> "countersign").

asadlionpk 4y ago

I hope Apple doesn't disable JS injection in WKWebViews in response to this. JS injection is the (only?) way to call native Swift methods from JS ie. bridging. I am not sure what the solution here is. Maybe only allow injection to sites you control (via apple association file).

nofunsir 4y ago
I hope they do.
throwaway290 4y ago
Wait, websites can call native Swift methods from JS?
- Linkd 4y ago
  Certainly. See https://developer.apple.com/documentation/webkit/wkscriptmessagehandler https://developer.apple.com/documentation/webkit/wkscriptmes...
- _rend 4y ago
  Only intentionally, via setup from a hosting app. If an app uses a WKWebView to display web content, it can use WKUserContentController[1] to inject scripts and additional content into the page dynamically, and can inject functions into JS[2] which will trigger native callback handlers when called. If your app uses the JavaScriptCore[3] framework to run JS in a VM in-process directly, you have even more options for interfacing between JS and native code. Note that this has to be explicitly hooked up by the app (i.e., none of this applies within, say, Safari). [1]: https://developer.apple.com/documentation/webkit/wkusercontentcontroller https://developer.apple.com/documentation/webkit/wkuserconte... [2]: https://developer.apple.com/documentation/webkit/wkusercontentcontroller/1537172-add https://developer.apple.com/documentation/webkit/wkuserconte... [3]: https://developer.apple.com/documentation/javascriptcore https://developer.apple.com/documentation/javascriptcore
- Spivak 4y ago
  Short answer: yes With the appropriate libraries you can use JS to call Swift and Obj C code. Long answer: no All it really means is that the JS and Swift/Obj C can pass data between each other and the library is set up to parse that data and call the appropriate code. It's just an automatic RPC.

greenie_beans 4y ago

i always just assumed this and used the app accordingly. but glad there is some proof.

andix 4y ago

It would be interesting if this violates rights of the website owner the user is visiting. I known that embedding content of other websites into your own via an iframe can be a copyright violation. And what Meta does here is more or less like an iframe.

AtNightWeCode 4y ago
I believe so. Copyright and TOS of the sites. Copyright also in the sense that content have been changed. This should be on pair with banner swap techs.
upupandup 4y ago
It isn't. By that logic any browser is liable for violating ToS of websites, which btw isn't the law and you are not obligated to follow anyhow. This of course is a different case for corporations with a dedicated legal team.
- andix 4y ago
  First Instagram is not a browser. And second the browser manufacturer (usually) doesn’t make any money by tracking their users. They provide them with a tool, a browser. There is the browser Brave, that replaces ads on websites (and makes some profit with that), and there are some serious legal issues coming with that.
  - avalys 4y ago
    Seems like Instagram _is_ a browser. The right you seem to be claiming is “you can’t render my website in your app if I don’t like your app”, and that’s not how it works.
    - andix 4y ago
      So why are iframes then not allowed by some legislations? Because an iframe is also "just a browser".
  - 4y ago

notatoad 4y ago

>I’ve disclosed this issue with Meta through their Bug Bounty Program lol. and this is why companies can be hesitant to run bug bounty programs. it's not a place to complain about things you don't like. Meta/instagram has made a design decision here. just because you don't like it, doesn't mean it's a vulnerability.

lrvick 4y ago
Remember this is the same company that just gave police DMs that aided in an abortion investigation. If those had been end to end encrypted that risk would not have existed, but they made a business decision to leave the application vulnerable to spying for profit reasons. That is a vulnerability, in the same way we call it a vulnerability when an entity man-in-the-middles a browser to spy on people. Personal user browsing or communications leaking in plain text to private companies without explicit and obvious user consent puts users at risk, and is a vulnerability. It just so happens to be one arising from malicious profit seeking behavior that happens to be the status quo. Not having https was once the status quo, and a boon for corporate spying, but we call that a vulnerability now because the abuses became too big too ignore.
- 202206241203 4y ago
  Yes, but people love that, otherwise e.g. freemium and ad-driven games would not exist. Consumers have a payment-avoiding behaviour as a status quo.
  - lrvick 4y ago
    This comes across as victim blaming. Users are given the choice to accept risks that are buried on page 7 of privacy policies only a lawyer could understand the tricks in. Services knowingly endangering unknowing users for money should be like cigarettes and be forced to say on the signup page in big bold text they can and will sell user data to anyone, including law enforcement. Users largely think free services are like public libraries and do not default to expecting they are being exploited for money. Element, Wikipedia, and duckduckgo exist for free without selling user data so it is not a given that exploitation is always present in free services.

benbristow 4y ago

One thing I've noticed is that content-blockers/adblock don't seem to work within the Facebook/Instagram etc. in-app browsers so I usually end up jumping out of them anyway.

vuln 4y ago
Yup same. I jump out as soon as it attempts to load and I have the ability.
saagarjha 4y ago
Content blockers only work in Safari and SFSafariViewController.
thallium205 4y ago
The worst is when the link is YouTube and I have to watch an ad even though I pay for YouTube Premium but because it launched in an app browser I'm not logged in.

scraplab 4y ago

As a provider is it possible to defend against this with a Content Security Policy or does this mechanism override the site’s CSP?

robocat 4y ago
MDN docs for Content Security Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP (for anyone unfamiliar with that browser feature that should in theory disallow injection for websites you control).
the_mitsuhiko 4y ago
External sources yes, preventing an app to inject inline HTML and JavaScript is tricky.
- ezekg 4y ago
  You can block all inline scripts via CSP.
  - the_mitsuhiko 4y ago
    That’s why I said tricky and not impossible.
xfitm3 4y ago
Strides have been made in web security, check out the permissions policy[0] along with COOP and COEP[1]. [0] https://www.w3.org/TR/permissions-policy-1/ https://www.w3.org/TR/permissions-policy-1/ [1] https://scotthelme.co.uk/enabling-coop-and-coep-reports-on-report-uri/ https://scotthelme.co.uk/enabling-coop-and-coep-reports-on-r...
RKearney 4y ago
Not only would CSP block it, but this type of behavior only strengthens Apple's decision to not allow third party rendering engines. Could you imagine the privacy nightmare that would ensue if Facebook could release a browser that bypassed any and all safeguards implemented by site operators?

AtNightWeCode 4y ago

I believe this is not legal. It is a grey area for users to do things like this but for a browser to change the actual contents is illegal on most sites. Or at least, there is no general way for a browser to validate if it is legal or not.

AtNightWeCode 4y ago
HN should really get rid of the down votes... Please explain why you think it is legal for a proxy to inject custom scripts. I am sure our TOS states that this is not allowed. Also, I think it basically is a copyright infringement.

elorant 4y ago

That's the definition of a malware.

sneak 4y ago

If these platforms do things that are abusive and invasive, the solution is not to complain about it, the solution is to stop donating content to them for free and delete your account so they aren't attractive to more users. Continuing to enrich them, even by your reachability via their DM messengers, makes them more attractive to your friends and family. Delete your Facebook and Instagram accounts. Stop giving them positive feedback (via continued usage and content donations) after they make clear choices to abuse you.

nodejsthrowaway 4y ago

Is this different from my android experience where I open a link from an app and it opens my default browser, Firefox, but kind-of within the app, but allows me to instantly switch over to the Firefox app instead using a drop-down menu option?

Flimm 4y ago
iOS provides a way of showing a browser that looks like it's within the app from which it is launched. This is not what Instagram is doing. Instagram is doing something different from what other apps like Telegram do, according to the article: > Comparing this to what happens when using a normal browser, or in this case, Telegram, which uses the recommended SFSafariViewController: > As you can see, a regular browser, or SFSafariViewController doesn’t run any JS code. SFSafariViewController is a great way for app developers to show third party web content to the user, without them leaving your app, while still preserving the privacy and comfort for the user.
izacus 4y ago
Android has two ways of doing that - Chrome Custom Tabs which are secured against this (iirc) and WebView which isnt. Custom Tabs always have a title bar and a small writing "Powered by <browser>" at the end of the menu.

cdransf 4y ago

If you insist on running Meta's spyware on your devices you can also use a service like nextDNS to block trackers at the device DNS level: https://apple.nextdns.io https://apple.nextdns.io

kart23 4y ago

surprised this is at the top of HN. isn’t it obvious that every app does this? tiktok, snapchat, even linkedin all open links in their built-in browser and can track what you’re doing. click open in safari if you’re doing anything more than visiting a single page.

plif 4y ago
Yep, this is a feature, not just for tracking but also containment when navigating to external links. Big reason why all of those apps and others aggressively push users from web to mobile.
SnowHill9902 4y ago
It’s not obvious but it is reasonable.
madeofpalk 4y ago
It's not surprising, but it's not obvious.
InCityDreams 4y ago
>isn’t it obvious that every app does this? Not if you never have/ don't use them.
MrStonedOne 4y ago
joshstrange 4y ago
I was/am a little surprised since I thought everyone had to use SFSafariViewController for stuff like this (which doesn't allow the developer to reach in). I "eject" out to Safari almost always when I get in in-app-browser (if only for cookies/logged in status) so this doesn't affect me much but it did come as a surprise.
somerando7 4y ago
To me it's not obvious. I wouldn't think that an app can inject JS into a website because I'm using a web-browser from their app.

cloudyporpoise 4y ago

The battle for control continues. I started noticing this personally when using social media and took note of the fact that the browsing was still being done within the app when clicking on an external link. The war on control of data continues on.

thallium205 4y ago
Facebook used to have a feature in their settings where you could opt out of their in app browser. No longer.

wonderbore 4y ago

Please tell every newspaper to publish this so Apple puts a stop to this. I have no idea why they allow this. All apps should use Safari unless they’re a browser and this rated “18+”

TaylorAlexander 4y ago
Well I like when browsing reddit that when I open links they are sandboxed. The in-app browser in that case has an easy button to open to get to my normal safari if I want to.
- wonderbore 4y ago
  I’d much rather seen a system-wide “container” implementation a-la-Firefox instead. Safari is pretty good at this but not as good as Firefox. I really want my real-life accounts be segregated from the rest of the internet. Reddit should never be able to know what other sites I use.
  - TaylorAlexander 4y ago
    Under the implementation in the Reddit app I use (BaconReader), links open in a webview that is an isolated instance of WebKit or whatever the safari engine is called. So already Reddit does not know what other sites I use. Reddit does not have access to the content of my normal safari instance.

dazbradbury 4y ago

Websites need cookie notices, but apps can track your full web usage (albeit within the in-app browser) without any such notice or opt in? Doesn't seem like this would be legal. Anyone know how this could be compliant in the EU? It's also frustrating that on an android device you can't simply disable in-app browsers globally.

Nextgrid 4y ago
GDPR enforcement is significantly lacking. There's basically zero ways this is compliant unless it's opt-in (but who in their right mind would opt-in?) but the regulators aren't interested in standing up to these nasty companies.
flipbrad 4y ago
The EU+UK e-privacy "cookie" rule applies to apps in the same way as anything else that's sending/receiving data over a public network (e.g. the Internet): all storage of information to, or reading of information from, the end-user device requires their free, informed and specific consent, unless it's a technical necessity for the service they requested, or certain limited (technical) purposes like load balancing. How strictly this is enforced by regulators has waxed and waned over time and from one country to another. Civil litigants, however, have had pretty good results in the courts (or just threatening litigation) - e.g. the Lloyd and Vidal-Hall cases against Google in the UK
fleddr 4y ago
I'm not familiar with the Instagram signup flow but it may very well be that the user did opt-in at one point. The opt-in would of course only be valid if there's also a clear "reject" option.

guelo 4y ago

Apps in general are awful for users. I do all my mobile social media browsing on the web where I have much more control over things like copying text, saving images, zooming, adblockers, privacy tools, etc.

graham1776 4y ago

I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to all the "apparent" unsafe sites, there are still ways to access the unfiltered internet inside of these safe apps. How? Usually buried in App Settings. Almost all apps use some instance of an in-app browser to (lazily) reference thier privacy policies, EULAs, or TOCs. A buried link leads to a homepage, leads to an instagram link, leads to an unfiltered internet. Yes they are long, inefficient paths to reach the internet, but curious (or motivated) individuals or children will use almost any app to reach the internet. Even boring apps like MS Teams or adding a Gmail account to iOS mail uses a secret in-app browser. This obviously presents a problem: should developers restrict any and all app access to in-app browsers, or leave policing to individuals/parents? An easy approach is to disable the in-app browser functionality in iOs, but obviously with grave cost to developers. At the same time, at what cost is in-app browser functionality being implemented.

davet91 4y ago
The in-app browsers could use a domain whitelist if parental controls are turned on.
- graham1776 4y ago
  That could be an "easy" fix where you could disable use of in-app browsers through Screen Time options.
- yowzadave 4y ago
  Shouldn't an in-app browser whose sole purpose is to read an app EULA/TOC/etc. always employ a domain whitelist, regardless of parental controls?
- adaktix 4y ago
  It shouldn't be a parental controls thing for IG, it just needs to be made so when you're using an in-app browser, you're using it for one reason, whatever site you clicked on. Leaving the domain ends the process or opens in another browser.

stjohnswarts 4y ago

isn't this true for all in-app browsers?

ma_arkus 4y ago

Meta (Facebook, Instagram, Whatsapp) is the sneakiest, impertinent and most evil company of all them all. Much worse than the tracking and spying is how Meta does everything to make people addicted to their slot-machine like services and thereby destroying their mental health. Especially harmful for kids. The world would be a much better place without it.

iamjk 4y ago

Isn't this... what everyone (that uses in-app browsers) does? I just assumed that's a big reason why one would use in-app over sending a person to their native environment, which is decidedly a better browsing experience.

yreg 4y ago
I think that in times when user just quickly checks some website the better UX is to stay in the app, so there would be legitimate use cases. e.g. Apollo by iamthatis here on hn does this and I very much doubt he is doing it for tracking reasons.
- account42 4y ago
  - yreg 4y ago
    I believe it is. Don't forget to go write your helpful 'No.' here as well. https://news.ycombinator.com/item?id=32423517 https://news.ycombinator.com/item?id=32423517

mikewhy 4y ago

If an app uses the non-OS supplied web view I just assume they're doing nefarious things. Coincidentally the only apps I have that don't use the OS supplied web view are from Meta.

nelblu 4y ago

I have always hated inapp browsers. I am a degoogled android user, and I despise any app that defaults browsing to inapp browser. If you are a developer who is defaulting to inapp browser, please stop doing it. (Biggest reason I hate inapp browsing is my ad-blocker and custom ublock origin scripts don't work correctly.)

benguild 4y ago

Obviously! That’s the whole reason they don’t just use the Safari modal

joshstrange 4y ago

I was super confused by this since to the best of my knowledge SFSafariViewController blocks anything like this, you, as a developer, cannot inject anything or peak into the view it creates. Then I got to the bottom and realized I was correct, but FB/Meta/IG/etc aren't using SFSafariViewController and instead using the older ways to embed a web view. Honestly I thought all other methods had been deprecated and had no idea apps could still make use of the less secure (for the user) options. Trust me, as a developer I've wanted to reach inside a SFSafariViewController many times to make my life easier but in the end I've just grumbled and assumed it's not possible and worked around it. I wish there was a privacy-safe way to get the best of both worlds but due to bad actors I doubt that will be possible. I need to look more into App-bound domains but I don't think even that will give me what I really wish for (a way for the page loaded in SFSafariViewController to tell my app something). Something like postMessage support for SFSafariViewController would be amazing and be safe privacy-wise I think since the contained page would need to support sending/receiving messages instead of just having code injected against their will.

koenvdb 4y ago
At our company we use Cordova for all our apps, which means we have to use WKWebView in order to render our application. As does ever Cordova app.
raxxorraxor 4y ago
But the solution isn't to enforce a specific browser or way to access web content. The solution is to educate users about the toxic software landscape on smartphones and the security threats of using apps. Ironically these supposedly checked apps behave vastly worse than the vast majority of software you can just install on a less locked down system. Because there the better alternatives mostly win.
YourGrace 4y ago
Yes, developers are able to leverage WKWebview on iOS and a Webview on Android. One thing about both webviews is that there are callbacks with these implementations that developers can choose to open a link in the embed webview or not. It might be useful for privacy/security for Apple/Android to force developers to allow-list a domain (like iOS's Associated Domains) or such that an embedded webview can load (besides local html and files). It might be something in addition to the developer's callback. iOS WKWebview: https://developer.apple.com/documentation/webkit/wkwebview https://developer.apple.com/documentation/webkit/wkwebview Android Webview: https://developer.android.com/guide/webapps/webview https://developer.android.com/guide/webapps/webview Associated Domains: https://developer.apple.com/documentation/Xcode/supporting-associated-domains?language=objc https://developer.apple.com/documentation/Xcode/supporting-a...

blueagle7 4y ago

Does anyone know if something like Hyperweb would affect the tracking in this?

rdtwo 4y ago

Can you use an in-app browser to host a light weight proxy server? Thereby allowing a 3rd party to access anything behind the firewall as local traffic or pretend to be the machine.

hnburnsy 4y ago

I'm confused I thought Apple only allowed web browsing via Safari... "2.5.6 Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript." If apps can use their own in app browser, why can't say Brave for example, create an app that does very little, except it browses the web with its own in app browser?

superjan 4y ago
This just forbids developers to write their own browser engine. It is OK to use the iOs provided webbrowser as a control in your app.

grishka 4y ago

Ah so that's why they insist so much on opening every single link in their crappy in-app browser. I decompiled and patched Instagram for Android, and I did try, among other things, to bypass that browser (and gave up because my approach somehow mysteriously broke navigation in the app), but the thought that they're using it to track you has never once crossed my mind.

nmeofthestate 4y ago

Of course. That's the point of in-app browsers right?

hollowturtle 4y ago

I’m not surprised and it’s really annoying apps still use in-app browsers. I remember even Telegram had that at one point, with link opening only on in-app browser(at least on iOS). But what really annoys me is that most of the users, e.g. my girlfriend, have NO IDEA about the difference, it’s just a browsing window, no matter in-app, which engine, with which privacy feature. Perhaps os vendors should show more obvious UI, and UX wise, tell you you’re leaving a safe browsing experience?

makoto12 4y ago
in-app browsers are a much better UX imo, solution is to make them safe, not get rid of them, as they solve a real ux use case
- xigoi 4y ago
  Android has “Chrome custom tabs” (terrible name, they don't have to be Chrome) which behave like an in-app browser, but use an actual browser. I assume the app can't spy on those?
- kevincox 4y ago
  How is the UX better? It is just a browser window with half of the features. I turn it off in every app I can and miss the old version of Firefox that had the option to disable them altogether.
  - makoto12 4y ago
    it's not the browser itself, it's the experience of staying in app when clicking a link. for example when going through a paygate that redirects to a browser. i don't want to leave the app, then come back in manually. with an in app browser it works seamlessly.
    - kevincox 4y ago
      What does "in app" do differently? On Android the only thing I can think of that is different is that if I open the app switcher the tab is in a different app. But I think I prefer that because if I click around a bit I can switch back to the app that spawned the tab directly instead if hitting back a load of times.

georgex7 4y ago

Another reason why we hate Zuck: https://backtohumanity.substack.com/p/why-people-hate-zuck https://backtohumanity.substack.com/p/why-people-hate-zuck

mtlmtlmtlmtl 4y ago

There is no reason for in-app browsers to exist besides tracking really, so this isn't all that surprising. The only effect of removing them entirely would be that stuff just worked better in general.

bacan 4y ago

In-App browsers have always been a security nightmare. Similar issues exist with Electron apps as well. But developers continue to use them as HTML + CSS + JS is the easiest way to develop a graphical dynamic UI, for a newbie. Many schools & colleges even teach basic HTML, CSS & JS, so the barrier to entry is very low. I am not sure what a good solution here would be, but maybe we could start by limiting access. Or another way could be to have some way to convert the rendered UI to compiled binary code

xfitm3 4y ago
Good call out on Electron apps, I try to avoid Electron as much as possible. I use Slack's web interface for example. I never made the connection until you brought it up, but yes, Electron apps are just like using Webkit on iOS. Abstracting UI/UX to a browser engine which has identical security pitfalls to a browser but with far less control and inspection capability.

riazrizvi 4y ago

Only Instagram? Every app maker who makes an in app browser can see what you do, that’s the point of embedding it. And why not? You arrive there because of a link in the container app you clicked on. They want to see what you do with the link they gave you. Otherwise only Google/Apple can see what you do with it. Someone can see what you do with the link no matter what.

altairprime 4y ago
Not necessarily. If they’re using a WKWebView, they can’t see what you’re doing, which is why Safari Autofill remains enabled in some but not all app-embedded web views.
- manmal 4y ago
  This is not correct. WKWebView can be made to report back clicks and URL loads, inject JS etc. Eg here is the doc for the navigation delegate: https://developer.apple.com/documentation/webkit/wknavigationdelegate https://developer.apple.com/documentation/webkit/wknavigatio...
- faizmokhtar 4y ago
  Only SFSafariViewController prevents that. Devs still can inject javascript through WKWebView.
  - altairprime 4y ago
    Thanks for the correction; I swapped the two in my head and you’re right.
Tepix 4y ago
The problem is that users cannot tell if they are being spied upon or not as long as they use in-app browsers. Avoid them! Go web apps instead of native apps for better privacy in general. Regardless, i don't consider it to be acceptable behaviour by Instagram to inject their tracking into all web pages i access through their app just because they can.
4y ago

spoonjim 4y ago

Every app that uses an in-app browser (which is most of them) can do this. This is a clickbait headline that relies on "Blue Company Bad" sentiments.

bhelkey 4y ago
> The [iOS] Instagram app injects their tracking code into every website shown, including when clicking on ads, enabling them monitor all user interactions The allegation isn't that Instagram can do this but that they are.

karek 4y ago

Why is this legal?

smm11 4y ago

I already fixed it, by not using Instagram.

chadlavi 4y ago

It's really concerning that everyone treats their children like prisoners. Your kids are gonna find a way to look at what they want anyway, why make it MORE appealing to them by making it verboten? Are you protecting them or are you controlling them?

twodave 4y ago
Some kids (and adults) literally aren’t capable of impulse control. It’s actually nice to be able to hand that control over to somebody else in some cases. And, as a parent if I know my child struggles with this it would be negligent of me to let them harm themselves knowing they can’t stop themselves. I have four children and if there is any generalization about raising kids that I have learned it is that each child has different needs.

deleted 4y ago

[deleted]

dzikimarian 4y ago

I'm surprised that so many people write "yeah, any in-app browser can do that - nothing to see here". Anyone can potentially steal your wallet, so we shouldn't point out when someone actually does? Especially when there's hard evidence in article?

MomoXenosaga 4y ago
Every app and or website steals your wallet and when you point this out to people in tech who code this shit they respond with "just following orders". Installed system wide ad blockers ages ago and got on with my life.

eis 4y ago

They not only track very invasively what you are doing but they create real problems for websites because certain features wont work anymore. Be it due to them disabling them or third party services having to block their usage because of the huge privacy and data safety issue. Simple example: try to use "Login with Google" from within one of those in-app browsers and you will notice Google had to actively detect them and block the attempt because otherwise the app could spy on the login credentials without anyone noticing. Instagram, Twitter, Facebook Messenger, TikTok.... the list goes on and on. I am very confident that these companies are breaking GDPR laws left and right on an absolutely massive scale. They are spyware at this point.

klabb3 4y ago
I'm with you. If you're navigating to a website, you should open the web browser. The app shouldn't monitor or inject crap when I'm going to an unaffiliated site. The worst offenders are the ones that force you to enter credentials for a 3p account with an in-app browser. That said, it's a huge UX failure that navigating between the web and an app is so broken. That doesn't mean that it's motivated to break the fundamental models of the web. Long term it does much more harm than good. How do you teach non-technical users good practices if developers circumvent these barriers anyway? "Trust us, we won't steal your Google account" is not exactly reassuring, but ok say that you trust a reputable app to do that. What happens when the user normalizes this behavior and a less reputable app does the same thing? Obviously many users will have no idea of the risk.

nxtbl 4y ago

Open in [X] Firefox Focus and it forgets everything when you close it.

solarkraft 4y ago

No shit! Instagram tracks what I do in the Instagram app!

eis 4y ago
You get a link inside Instagram to some website that does not belong to Instagram. It is none of Instagrams business what you do on that website. People do not even realise they are still inside Instagram while logging into their bank account and Instagram keeping a log of some of their activity inside that bank website. It's insane.

captaincrunch 4y ago

I generally assume that if I am using a browser IN ANOTHER APP, its tracking it - or could. Not hard to do

deleted 4y ago

[deleted]

echobear 4y ago

glad I just deleted instagram lol

lawgimenez 4y ago

The only way out of this if Google and Apple can remove Javascript support in both WebView and WKWebView.

izzytcp 4y ago

Common people, this is not news. At least for Hacker News.

dang 4y ago

Related ongoing thread: Let websites framebust out of native apps - https://news.ycombinator.com/item?id=32418679 https://news.ycombinator.com/item?id=32418679 - Aug 2022 (37 comments)

odd_chimera_out 4y ago

I had assumed this with all browsers, otherwise why are they free? Ive been told by a very destinguished person (Judge) that "if its too good to be true then its not (i.e. something expensive is rediculously cheap, its obviously stolen), and anyone with a highschool education +, could determine that." why would a judge say that if its not true = must be true when thats the way the law sees it, then its kind of hard to argue. "nothing in life is free"

smrtinsert 4y ago

Is there evidence Instagram takes advantage of this? Shameful if so.

mbrochh 4y ago

There is nothing of real value on Instagram. Just delete your account and never look back.

zsims 4y ago
Um excuse me, how will people know I had an açai bowl for lunch?
driverdan 4y ago
neop1x 4y ago
My words. People are just wasting their time in these useless ad-selling services.

DarthNebo 4y ago

This is nuts, injecting code without website consent, pretty much like shady-ISP behaviour!

marsven_422 4y ago

BroadbandSurfer 4y ago

Separate yourself from big tech as much as possible and switching to only FOSS Software/Apps can be a great start for many who want more privacy. Can go way more into other ways but too tired, also most who are surprised by this just need a starting point. Btw, Apple and Mozilla are no privacy guardians out to protect you. These days they do just as bad.

larkinrichards 4y ago

> How can I protect myself? For full details scroll down to the end of the article. Summary: Whenever you open a link from Instagram (or Facebook or Messenger), make sure to click the dots in the corner to open the page in Safari instead. “How do I protect myself?” should be point number one. Does apple require that developers allow users to open these links in safari—- w/o tracking? Or do developers feel this is the only moral way they can agree to this user-hostile behavior?

ryanmercer 4y ago

I assume any app can see everything I do if I use their in-app browser just like I assume every brick and mortar store can see everything I do inside their store.

whatsthatabout 4y ago

Always thought Meta would absolutely do something creepy like this. Just ditched my app for the web app - bonus feature: No more ads (if you have a safari adblocker installed)

anonymous344 4y ago

This s*it should be illegal. Let's say Tiktok for example, it opens everything in who-knows-what-they-track webview that has even the copy to clipboard function disabled. Where is EU when you need them??

deleted 4y ago

[deleted]