6 ms·

TikTok’s in-app browser could be keylogging, privacy analysis warns

62 points by hubraumhugo 4y ago

bloomsa 4y ago
I found this website on reddit that is intended to be opened using inapp browsers and tells you what JS is injected into the browser (to the best of its ability) https://inappbrowser.com/ https://inappbrowser.com/ source: https://reddit.com/r/InternetIsBeautiful/comments/wry2xz/see_what_javascript_commands_get_injected_through/ https://reddit.com/r/InternetIsBeautiful/comments/wry2xz/see...
- puyoxyz 4y ago
  that’s the site made by the person who wrote the original blog post this article is based off of !
lizardactivist 4y ago
I think Twitter does the same with their in-app browser. Is there any way to configure to use your regular browser instead?
- whylo 4y ago
  For Twitter it's Settings and Privacy > Accessibility, display and languages > Display > Web browser > Use in-app browser This is on Android, I'm not sure if it's the same on iOS
- ccouzens 4y ago
  Use the website rather than the app. Links from the web app will open in your regular browser.
gargs 4y ago
Any Safari extension could theoretically do the same, even if it is available on the AppStore. I doubt app review does security audits of extensions they approve.
- pornel 4y ago
  Safari content blockers are passive and don't run arbitrary code on pages.
  - gargs 4y ago
    You're right. Editing.
DarthNebo 4y ago
So does Instagram
- colejohnson66 4y ago
  Yep. There was a report about how all in-app browsers can do this, and that FB/IG/Twitter/etc. all did it. But, of course, saying TikTok does it gets the clicks.
  - zwily 4y ago
    Reports I read said that while they all inject code, TikTok was the worst, injecting code that intercepts every key press and click.
    - yellow_postit 4y ago
      On iOS at least there are more restrictions of using SafariViewController vs WebView. I could imagine Apple making a policy change to force towards that stricter surface.
DonnyV 4y ago
Is anyone really shocked by this?
fzfaa 4y ago
pvg 4y ago
Big thread yesterday: https://news.ycombinator.com/item?id=32514793 https://news.ycombinator.com/item?id=32514793
Quikinterp 4y ago
I'm confused, how do I even get to the in app browser? If someone links me something on tiktok?
- klausjensen 4y ago
  Exactly.
bluetidepro 4y ago
This isn't surprising at all, but also it's a bit alarmist. Who ever uses the in-app browser other than to follow a quick link that usually opens up a native app from there (like YouTube, for example)? Seems like nothing to stress about really, esp. if you're already okay being on these apps to begin with.
- deleted 4y ago
  [deleted]

62 points by hubraumhugo 4y ago

I found this website on reddit that is intended to be opened using inapp browsers and tells you what JS is injected into the browser (to the best of its ability) https://inappbrowser.com/ https://inappbrowser.com/ source: https://reddit.com/r/InternetIsBeautiful/comments/wry2xz/see_what_javascript_commands_get_injected_through/ https://reddit.com/r/InternetIsBeautiful/comments/wry2xz/see...

puyoxyz 4y ago
that’s the site made by the person who wrote the original blog post this article is based off of !

lizardactivist 4y ago

I think Twitter does the same with their in-app browser. Is there any way to configure to use your regular browser instead?

whylo 4y ago
For Twitter it's Settings and Privacy > Accessibility, display and languages > Display > Web browser > Use in-app browser This is on Android, I'm not sure if it's the same on iOS
ccouzens 4y ago
Use the website rather than the app. Links from the web app will open in your regular browser.

gargs 4y ago

Any Safari extension could theoretically do the same, even if it is available on the AppStore. I doubt app review does security audits of extensions they approve.

pornel 4y ago
Safari content blockers are passive and don't run arbitrary code on pages.
- gargs 4y ago
  You're right. Editing.

DarthNebo 4y ago

So does Instagram

colejohnson66 4y ago
Yep. There was a report about how all in-app browsers can do this, and that FB/IG/Twitter/etc. all did it. But, of course, saying TikTok does it gets the clicks.
- zwily 4y ago
  Reports I read said that while they all inject code, TikTok was the worst, injecting code that intercepts every key press and click.
  - yellow_postit 4y ago
    On iOS at least there are more restrictions of using SafariViewController vs WebView. I could imagine Apple making a policy change to force towards that stricter surface.

DonnyV 4y ago

Is anyone really shocked by this?

fzfaa 4y ago

pvg 4y ago

Big thread yesterday: https://news.ycombinator.com/item?id=32514793 https://news.ycombinator.com/item?id=32514793

Quikinterp 4y ago

I'm confused, how do I even get to the in app browser? If someone links me something on tiktok?

klausjensen 4y ago
Exactly.

bluetidepro 4y ago

This isn't surprising at all, but also it's a bit alarmist. Who ever uses the in-app browser other than to follow a quick link that usually opens up a native app from there (like YouTube, for example)? Seems like nothing to stress about really, esp. if you're already okay being on these apps to begin with.

deleted 4y ago
[deleted]