Hacker News Reader

Comment by kart23 | Hacker News Reader

surprised this is at the top of HN. isn’t it obvious that every app does this? tiktok, snapchat, even linkedin all open links in their built-in browser and can track what you’re doing. click open in safari if you’re doing anything more than visiting a single page.

View on HN

I naively assumed that they were using a WebView object and that Apple had tight controls over source code injection. Silly me!

Apple has deprecated but not yet removed the legacy web embeds that app developers use to spy on and track their users.

They haven’t deprecated web views at all: https://developer.apple.com/documentation/webkit/wkwebview

WKWebView can indeed be used to spy on users - clicks can be intercepted, URLs sniffed, and custom JS injected (including a way to call back to the app’s runtime via a WebKit message passing mechanism). Considering all other iOS browsers (ok maybe some still run UIWebView) have been made using this component (because App Store reviews enforce this), it’s clear that it has to provide extensive control over displayed contents.

SFSafariViewController is available as a safer alternative. Presumably at some point apple will deprecate and remove WKWebView for precisely the reasons mentioned in this article.

I don’t think they’ll ever remove that, because a decent portion of apps serve HTML from the app bundle (many hybrid apps do nothing else infact) and SFSafariController can’t hide its chrome. Many hybrid apps do need the delegation methods WKWebView offers, which are already way more limited than UIWebView was.

This is a policy problem, not a technical one. They'll keep WKWebView around but only for non-browsing purpose. Anything that resembles a web browser, SFSafariController or rejection.

That policy was recently hinted at here: https://developer.apple.com/news/?id=trjs0tcd

But it hasn’t been enforced yet for big apps like Yelp and Instagram.

I’m wrong, and confused the older UIWebView with WKWebView.

It's not surprising, but it's not obvious.

To me it's not obvious. I wouldn't think that an app can inject JS into a website because I'm using a web-browser from their app.

Not every app does this. Twitter for example doesn't, because it uses SFSafariViewController which doesn't allow for script injecting.

I was/am a little surprised since I thought everyone had to use SFSafariViewController for stuff like this (which doesn't allow the developer to reach in). I "eject" out to Safari almost always when I get in in-app-browser (if only for cookies/logged in status) so this doesn't affect me much but it did come as a surprise.

It's so obvious to me I'm flabbergasted others here on HN don't think so.

In app browsers that display content unrelated to the app itself (like links from creators) serve zero purpose to the user and offer a horrible user experience. So why is the browser in-app then? I thought the answer was obvious: to track you.

Maybe some people prefer in-app browsers?

Yep, this is a feature, not just for tracking but also containment when navigating to external links. Big reason why all of those apps and others aggressively push users from web to mobile.

As a non mobile developer, no, this was completely surprising to me.

Also why is the headline "Instagram _can_ track anything you do on any website in their in-app browser"?

It’s not obvious but it is reasonable.

>isn’t it obvious that every app does this?

Not if you never have/ don't use them.

Reply on news.ycombinator.com