Hacker News new | ask | show | jobs
by hamiltont 1567 days ago
This is saying "if an app opens a webview, the app can monitor your browsing activity inside that webview."

It is written vaguely and should be re-written to be precise, but as they are going for "end user" language here I can understand that it is hard to communicate to non-technical users that "embedded browser" and "browser" are different things given that they have similar UX and similar functionality.

A common use case of an embedded webview is an app that uses a website for some portion of a user flow, IME this is typically when there is a B2B2C business relationship. I think it can also happen for an OAuth2 integration but I'd expect there are some iOS native SDKs that are preferred. IME, many businesses use "web SDKs" instead of native libraries, and their integration guide will say something like "have your app open a webview to URL X, then user does Y as we have agreed, then we will close the webview" (occasionally, a few will use hooks in the webview to communicate result information to the native app).
1 comments
wtaf-people 1567 days ago
That was my original assumption but how can you be so sure? I think you’re being too hopeful here.

Also calling webview “outside the app” is a bit of a stretch

link
hamiltont 1567 days ago
Not a stretch at all, it is perfectly reasonable to consider an app and an website embedded by the app as two completely different things. First there is no guarantee the WebView will open to a website owned/operated by the same entity that owns/operates the app, so it is definitely "outside the app". From the user's privacy perspective, you also want to communicate that just because the website might be branded "Facebook" and be run by Facebook and maybe you trust FB with your messages, but if it's an embedded browser opened via a WebView then the app can technically snoop on the private message you are typing into the WebView
link
wtaf-people 1567 days ago
I think you’re right but they really need to update the description for this
link
st3fan 1567 days ago
It doesn’t say “outside of the app”. It says “information about the content you have viewed, which is not part of the app, such as websites”, which is completely different.

This category exists for apps that embed a webview.

Safari is sandboxed. There is no way to get to its data like history.

link