6 ms·

surprised this is at the top of HN. isn’t it obvious that every app does this? tiktok, snapchat, even linkedin all open links in their built-in browser and can

by kart23 4y ago

surprised this is at the top of HN. isn’t it obvious that every app does this? tiktok, snapchat, even linkedin all open links in their built-in browser and can track what you’re doing. click open in safari if you’re doing anything more than visiting a single page.

plif 4y ago
Yep, this is a feature, not just for tracking but also containment when navigating to external links. Big reason why all of those apps and others aggressively push users from web to mobile.
SnowHill9902 4y ago
It’s not obvious but it is reasonable.
madeofpalk 4y ago
It's not surprising, but it's not obvious.
InCityDreams 4y ago
>isn’t it obvious that every app does this? Not if you never have/ don't use them.
MrStonedOne 4y ago
joshstrange 4y ago
I was/am a little surprised since I thought everyone had to use SFSafariViewController for stuff like this (which doesn't allow the developer to reach in). I "eject" out to Safari almost always when I get in in-app-browser (if only for cookies/logged in status) so this doesn't affect me much but it did come as a surprise.
somerando7 4y ago
To me it's not obvious. I wouldn't think that an app can inject JS into a website because I'm using a web-browser from their app.
M4v3R 4y ago
Not every app does this. Twitter for example doesn't, because it uses SFSafariViewController which doesn't allow for script injecting.
sixothree 4y ago
Also why is the headline "Instagram _can_ track anything you do on any website in their in-app browser"?
webercoder 4y ago
I naively assumed that they were using a WebView object and that Apple had tight controls over source code injection. Silly me!
- altairprime 4y ago
  Apple has deprecated but not yet removed the legacy web embeds that app developers use to spy on and track their users.
  - manmal 4y ago
    They haven’t deprecated web views at all: https://developer.apple.com/documentation/webkit/wkwebview https://developer.apple.com/documentation/webkit/wkwebview WKWebView can indeed be used to spy on users - clicks can be intercepted, URLs sniffed, and custom JS injected (including a way to call back to the app’s runtime via a WebKit message passing mechanism). Considering all other iOS browsers (ok maybe some still run UIWebView) have been made using this component (because App Store reviews enforce this), it’s clear that it has to provide extensive control over displayed contents.
    - semiquaver 4y ago
      SFSafariViewController is available as a safer alternative. Presumably at some point apple will deprecate and remove WKWebView for precisely the reasons mentioned in this article.
      - manmal 4y ago
        I don’t think they’ll ever remove that, because a decent portion of apps serve HTML from the app bundle (many hybrid apps do nothing else infact) and SFSafariController can’t hide its chrome. Many hybrid apps do need the delegation methods WKWebView offers, which are already way more limited than UIWebView was.
        xuki 4y ago
stevage 4y ago
As a non mobile developer, no, this was completely surprising to me.
davidmurdoch 4y ago
It's so obvious to me I'm flabbergasted others here on HN don't think so. In app browsers that display content unrelated to the app itself (like links from creators) serve zero purpose to the user and offer a horrible user experience. So why is the browser in-app then? I thought the answer was obvious: to track you. Maybe some people prefer in-app browsers?

by kart23 4y ago

plif 4y ago

Yep, this is a feature, not just for tracking but also containment when navigating to external links. Big reason why all of those apps and others aggressively push users from web to mobile.

SnowHill9902 4y ago

It’s not obvious but it is reasonable.

madeofpalk 4y ago

It's not surprising, but it's not obvious.

InCityDreams 4y ago

>isn’t it obvious that every app does this? Not if you never have/ don't use them.

MrStonedOne 4y ago

joshstrange 4y ago

I was/am a little surprised since I thought everyone had to use SFSafariViewController for stuff like this (which doesn't allow the developer to reach in). I "eject" out to Safari almost always when I get in in-app-browser (if only for cookies/logged in status) so this doesn't affect me much but it did come as a surprise.

somerando7 4y ago

To me it's not obvious. I wouldn't think that an app can inject JS into a website because I'm using a web-browser from their app.

M4v3R 4y ago

Not every app does this. Twitter for example doesn't, because it uses SFSafariViewController which doesn't allow for script injecting.

sixothree 4y ago

Also why is the headline "Instagram _can_ track anything you do on any website in their in-app browser"?

webercoder 4y ago

I naively assumed that they were using a WebView object and that Apple had tight controls over source code injection. Silly me!

altairprime 4y ago
Apple has deprecated but not yet removed the legacy web embeds that app developers use to spy on and track their users.
- manmal 4y ago
  They haven’t deprecated web views at all: https://developer.apple.com/documentation/webkit/wkwebview https://developer.apple.com/documentation/webkit/wkwebview WKWebView can indeed be used to spy on users - clicks can be intercepted, URLs sniffed, and custom JS injected (including a way to call back to the app’s runtime via a WebKit message passing mechanism). Considering all other iOS browsers (ok maybe some still run UIWebView) have been made using this component (because App Store reviews enforce this), it’s clear that it has to provide extensive control over displayed contents.
  - semiquaver 4y ago
    SFSafariViewController is available as a safer alternative. Presumably at some point apple will deprecate and remove WKWebView for precisely the reasons mentioned in this article.
    - manmal 4y ago
      I don’t think they’ll ever remove that, because a decent portion of apps serve HTML from the app bundle (many hybrid apps do nothing else infact) and SFSafariController can’t hide its chrome. Many hybrid apps do need the delegation methods WKWebView offers, which are already way more limited than UIWebView was.
      - xuki 4y ago

stevage 4y ago

As a non mobile developer, no, this was completely surprising to me.

davidmurdoch 4y ago

It's so obvious to me I'm flabbergasted others here on HN don't think so. In app browsers that display content unrelated to the app itself (like links from creators) serve zero purpose to the user and offer a horrible user experience. So why is the browser in-app then? I thought the answer was obvious: to track you. Maybe some people prefer in-app browsers?