2 ms·
TikTok’s In-App Browser Includes Code That Can Monitor Your Keystrokes
- K0nserv 4y agoI wrote a comment[0] about this in one of the other threads on this topic, but it bears repeating. Apple started working on a solution to this problem in 2020, called App-Bound Domains[2]. I always expected them to make this mandatory instead of opt in eventually. In response to this recent focus on in app browser they could accelerate such a timeline. With mandatory App-Bound Domains, an app would have to list the set of domains it wants to inject JS into in the app manifest. Further, those capabilities are only available after the web view has been restricted to forbid navigation away from the app bound domains. TL;DR: Apple could fix this tomorrow if they wish. 0: https://news.ycombinator.com/item?id=32523474 https://news.ycombinator.com/item?id=32523474 1: https://news.ycombinator.com/item?id=32514793 https://news.ycombinator.com/item?id=32514793 2: https://webkit.org/blog/10882/app-bound-domains/ https://webkit.org/blog/10882/app-bound-domains/
- lapcat 4y agoAlready a bunch of HN submissions about this: https://news.ycombinator.com/item?id=32514793 https://news.ycombinator.com/item?id=32514793 https://news.ycombinator.com/item?id=32518196 https://news.ycombinator.com/item?id=32518196 https://news.ycombinator.com/item?id=32518900 https://news.ycombinator.com/item?id=32518900 https://news.ycombinator.com/item?id=32525966 https://news.ycombinator.com/item?id=32525966 https://news.ycombinator.com/item?id=32525995 https://news.ycombinator.com/item?id=32525995
- CatWChainsaw 4y agoI thought that the app itself could monitor keystrokes, too, if not recently then at some point in the past.