5 ms·

> malicious web apps could read data from other web apps and recapture their permissions to gain access to a user’s camera, microphone or location without a use

> malicious web apps could read data from other web apps and recapture their permissions to gain access to a user’s camera, microphone or location without a user’s consent. How is this even possible? It's shocking that these APIs even exist for any browser to use.

zer00eyz 3y ago
>> How is this even possible? It's shocking that these APIs even exist for any browser to use. https://www.theverge.com/24054329/microsoft-edge-automatic-chrome-import-data-feature https://www.theverge.com/24054329/microsoft-edge-automatic-c... Ask MS, they already did it.
- cqqxo4zV46cp 3y ago
  iOS and Windows’ security models are not remotely comparable. I can’t imagine that you’d be making such intellectually lazy comparisons if it wasn’t in the context of some perceived holy war.
- veeti 3y ago
  This is completely irrelevant to the discussion, there is no sandboxing on PC.
amelius 3y ago
I didn't read the article, but to me it sounds like Safari's security mechanisms need more work.
- MBCook 3y ago
  Safari is fine. Other browsers would have to be trusted, Apple doesn’t have a mechanism to ensure that they do what they’re supposed to. So until they have time to add one (remember they already had to create all the API‘s for third-party browsers to use), they’re not allowed to give Safari preferential treatment. So they had to remove the feature.
kemayo 3y ago
I assume you mean the "read data from other web apps" part. That'd be because there's (presumably) not a system-level way to launch a third-party browser in "web app mode", with all data siloed off per-PWA. Thus the only way they could currently make web apps work would be to launch the third-party browser and trust that it silos everything adequately itself internally. Apple could add a bunch of new APIs to support this case for third-party browsers. Presumably there's something equivalent that's being done for said web apps currently in Safari. But they're not wrong to say that there's not an existing system in place that said third-party browsers are already written to use. (And, you know, they're clearly not invested in trying to make this law succeed.)
- fock 3y ago
  the bunch of new APIs might just be a containerized copy of the users browser? Seems very easy.
  - kemayo 3y ago
    I think there's a lot of edge cases, and just spinning up an entire new data container for iOS Chrome and launching a web app inside it would probably make Chrome very confused. (It wouldn't know to hide its normal tab/browser UI, to not nag the user about logging into their google account, etc.) Like I said, Apple could totally make APIs so that Chrome could know it was being launched in a container with data isolation and should behave as a web app. Google could then adopt those APIs, with the alacrity that it's famous for showing with new iOS system APIs. But the behavior Apple is implementing here is probably how any default-browser that hadn't yet opted into those new APIs would have to behave. (To be clear: I think Apple is being petty here by not having those APIs announced. But "we're going to regress everything to bookmarks" is probably more DMA-compliant than "things are better when you use Safari, and we promise we'll extend that to other browsers someday".)
    - jquery 3y ago
      Bookmarks are superior to PWAs, anything that reduces the spread of PWAs is a good thing in my opinion.

zer00eyz 3y ago

>> How is this even possible? It's shocking that these APIs even exist for any browser to use. https://www.theverge.com/24054329/microsoft-edge-automatic-chrome-import-data-feature https://www.theverge.com/24054329/microsoft-edge-automatic-c... Ask MS, they already did it.

cqqxo4zV46cp 3y ago
iOS and Windows’ security models are not remotely comparable. I can’t imagine that you’d be making such intellectually lazy comparisons if it wasn’t in the context of some perceived holy war.
veeti 3y ago
This is completely irrelevant to the discussion, there is no sandboxing on PC.

amelius 3y ago

I didn't read the article, but to me it sounds like Safari's security mechanisms need more work.

MBCook 3y ago
Safari is fine. Other browsers would have to be trusted, Apple doesn’t have a mechanism to ensure that they do what they’re supposed to. So until they have time to add one (remember they already had to create all the API‘s for third-party browsers to use), they’re not allowed to give Safari preferential treatment. So they had to remove the feature.

kemayo 3y ago

I assume you mean the "read data from other web apps" part. That'd be because there's (presumably) not a system-level way to launch a third-party browser in "web app mode", with all data siloed off per-PWA. Thus the only way they could currently make web apps work would be to launch the third-party browser and trust that it silos everything adequately itself internally. Apple could add a bunch of new APIs to support this case for third-party browsers. Presumably there's something equivalent that's being done for said web apps currently in Safari. But they're not wrong to say that there's not an existing system in place that said third-party browsers are already written to use. (And, you know, they're clearly not invested in trying to make this law succeed.)

fock 3y ago
the bunch of new APIs might just be a containerized copy of the users browser? Seems very easy.
- kemayo 3y ago
  I think there's a lot of edge cases, and just spinning up an entire new data container for iOS Chrome and launching a web app inside it would probably make Chrome very confused. (It wouldn't know to hide its normal tab/browser UI, to not nag the user about logging into their google account, etc.) Like I said, Apple could totally make APIs so that Chrome could know it was being launched in a container with data isolation and should behave as a web app. Google could then adopt those APIs, with the alacrity that it's famous for showing with new iOS system APIs. But the behavior Apple is implementing here is probably how any default-browser that hadn't yet opted into those new APIs would have to behave. (To be clear: I think Apple is being petty here by not having those APIs announced. But "we're going to regress everything to bookmarks" is probably more DMA-compliant than "things are better when you use Safari, and we promise we'll extend that to other browsers someday".)
  - jquery 3y ago
    Bookmarks are superior to PWAs, anything that reduces the spread of PWAs is a good thing in my opinion.