6 ms·

Sure this sucks, but its the in-app browser. probably totally follows apples rules.

sybercecurity 4y ago
Can Apple really enforce what goes on in an app? Probably only by rejecting it from the app store, but that's risky on Apple's part and would cause a lot of user complaints.
- Cthulhu_ 4y ago
  To a point; they control all the interfaces, which is why an app like Facebook cannot access your photos, location or address book without your explicit permission. And Apple has gone for the nuclear option of removing apps from the store; not long ago they booted Fortnite, one of the big earners (billions in revenue of which Apple got a percentage through their commissions), after they added a means to circumvent the app store fees, starting a long proceeding into getting it lowered or dismissed entirely - partially successful in specific jurisdictions.
- ben7799 4y ago
  Apple should change the rules to reject apps that try to open links in an in-app browser instead of sending the user to Safari. Maybe as a workaround let Meta put up their own browser on the app store and make it possible for a user to choose to let let the FB app send links to the Meta browser for someone who really wants this behavior. But don't allow the FB app to do this with no way for the user to stop it. Chrome for iOS seems to exist for exactly the same reason, to provide a way for google to track users.
  - collaborative 4y ago
    Very hard to implement. Many apps use web views for core functions. These shouldn't spawn full Safari
  - nocsi 4y ago
    Facebook would just argue user experience - which is true, users do prefer to stay in the app. Users don’t really understand this behavior, however. I’m sure there have been users that have opened links in FB, then decided to go log into their bank on the same session. If apple were to address this, they might end up monitoring the inapp browser and prompting for the user to hop out into safari depending on the url. As of now, apps like FB discourage reopening sessions in safari. The worst ones are like LinkedIn which requires like 2-3 key presses to reopen in safari. It’s clear these apps have an incentive in keeping users within the inapp browser
jjulius 4y ago
>probably totally follows apples rules. I've only ever used Android, so I'm ignorant here to how iOS operates and, to a certain extent, the rules Apple has in place around this sort of thing. I would think, though, that this sentence is key: >The Facebook app gets around Apple privacy rules by opening web links in an in-app browser, rather than the user’s default browser, according to Wednesday’s complaint. If FB is supposed to follow iOS settings by opening links in the default browser set by the user, but is intentionally not doing that here so that they can maximize the data they collect, then yeah they'd be breaking rules.
- codazoda 4y ago
  I don't think there's any such rule. Ton's of apps open things in their own browser instead of leaving the app.
  - jjulius 4y ago
    Thanks for clarifying! :)
  - jefftk 4y ago
    I do wish there were such a rule, though, on both iOS and Android!
- jclardy 4y ago
  The "in-app browser" is Safari, not their own rendering engine (Which is explicitly disallowed.) The difference between in-app safari and external...is that the app can get callbacks for every link tapped within the in-app browser, and the app itself can inject javascript into each web page it loads, which essentially means unlimited perfect tracking for social networks (Since the user is already logged in to the app.) This sounds bad...but the integrated webview is necessary for things like Cordova/Ionic/React Native/etc to exist on the platform. It's also a byproduct of iOS's pre-multitasking days where launching out to Safari was a big context change, vs now where you can just swipe back to the app you were in.
  - 4y ago
latexr 4y ago
“Instagram and Facebook can track anything you do on any website in their in-app browser”: https://news.ycombinator.com/item?id=32415470 https://news.ycombinator.com/item?id=32415470

Can Apple really enforce what goes on in an app? Probably only by rejecting it from the app store, but that's risky on Apple's part and would cause a lot of user complaints.

Cthulhu_ 4y ago
To a point; they control all the interfaces, which is why an app like Facebook cannot access your photos, location or address book without your explicit permission. And Apple has gone for the nuclear option of removing apps from the store; not long ago they booted Fortnite, one of the big earners (billions in revenue of which Apple got a percentage through their commissions), after they added a means to circumvent the app store fees, starting a long proceeding into getting it lowered or dismissed entirely - partially successful in specific jurisdictions.
ben7799 4y ago
Apple should change the rules to reject apps that try to open links in an in-app browser instead of sending the user to Safari. Maybe as a workaround let Meta put up their own browser on the app store and make it possible for a user to choose to let let the FB app send links to the Meta browser for someone who really wants this behavior. But don't allow the FB app to do this with no way for the user to stop it. Chrome for iOS seems to exist for exactly the same reason, to provide a way for google to track users.
- collaborative 4y ago
  Very hard to implement. Many apps use web views for core functions. These shouldn't spawn full Safari
- nocsi 4y ago
  Facebook would just argue user experience - which is true, users do prefer to stay in the app. Users don’t really understand this behavior, however. I’m sure there have been users that have opened links in FB, then decided to go log into their bank on the same session. If apple were to address this, they might end up monitoring the inapp browser and prompting for the user to hop out into safari depending on the url. As of now, apps like FB discourage reopening sessions in safari. The worst ones are like LinkedIn which requires like 2-3 key presses to reopen in safari. It’s clear these apps have an incentive in keeping users within the inapp browser

jjulius 4y ago

>probably totally follows apples rules. I've only ever used Android, so I'm ignorant here to how iOS operates and, to a certain extent, the rules Apple has in place around this sort of thing. I would think, though, that this sentence is key: >The Facebook app gets around Apple privacy rules by opening web links in an in-app browser, rather than the user’s default browser, according to Wednesday’s complaint. If FB is supposed to follow iOS settings by opening links in the default browser set by the user, but is intentionally not doing that here so that they can maximize the data they collect, then yeah they'd be breaking rules.

codazoda 4y ago
I don't think there's any such rule. Ton's of apps open things in their own browser instead of leaving the app.
- jjulius 4y ago
  Thanks for clarifying! :)
- jefftk 4y ago
  I do wish there were such a rule, though, on both iOS and Android!
jclardy 4y ago
The "in-app browser" is Safari, not their own rendering engine (Which is explicitly disallowed.) The difference between in-app safari and external...is that the app can get callbacks for every link tapped within the in-app browser, and the app itself can inject javascript into each web page it loads, which essentially means unlimited perfect tracking for social networks (Since the user is already logged in to the app.) This sounds bad...but the integrated webview is necessary for things like Cordova/Ionic/React Native/etc to exist on the platform. It's also a byproduct of iOS's pre-multitasking days where launching out to Safari was a big context change, vs now where you can just swipe back to the app you were in.
- 4y ago

latexr 4y ago

“Instagram and Facebook can track anything you do on any website in their in-app browser”: https://news.ycombinator.com/item?id=32415470 https://news.ycombinator.com/item?id=32415470