5 ms·

I naively assumed that they were using a WebView object and that Apple had tight controls over source code injection. Silly me!

altairprime 4y ago
Apple has deprecated but not yet removed the legacy web embeds that app developers use to spy on and track their users.
- manmal 4y ago
  They haven’t deprecated web views at all: https://developer.apple.com/documentation/webkit/wkwebview https://developer.apple.com/documentation/webkit/wkwebview WKWebView can indeed be used to spy on users - clicks can be intercepted, URLs sniffed, and custom JS injected (including a way to call back to the app’s runtime via a WebKit message passing mechanism). Considering all other iOS browsers (ok maybe some still run UIWebView) have been made using this component (because App Store reviews enforce this), it’s clear that it has to provide extensive control over displayed contents.
  - semiquaver 4y ago
    SFSafariViewController is available as a safer alternative. Presumably at some point apple will deprecate and remove WKWebView for precisely the reasons mentioned in this article.
    - manmal 4y ago
      I don’t think they’ll ever remove that, because a decent portion of apps serve HTML from the app bundle (many hybrid apps do nothing else infact) and SFSafariController can’t hide its chrome. Many hybrid apps do need the delegation methods WKWebView offers, which are already way more limited than UIWebView was.
      - xuki 4y ago
        This is a policy problem, not a technical one. They'll keep WKWebView around but only for non-browsing purpose. Anything that resembles a web browser, SFSafariController or rejection.
        altairprime 4y ago
        That policy was recently hinted at here: https://developer.apple.com/news/?id=trjs0tcd https://developer.apple.com/news/?id=trjs0tcd But it hasn’t been enforced yet for big apps like Yelp and Instagram.
- altairprime 4y ago
  I’m wrong, and confused the older UIWebView with WKWebView.

altairprime 4y ago

Apple has deprecated but not yet removed the legacy web embeds that app developers use to spy on and track their users.

manmal 4y ago
They haven’t deprecated web views at all: https://developer.apple.com/documentation/webkit/wkwebview https://developer.apple.com/documentation/webkit/wkwebview WKWebView can indeed be used to spy on users - clicks can be intercepted, URLs sniffed, and custom JS injected (including a way to call back to the app’s runtime via a WebKit message passing mechanism). Considering all other iOS browsers (ok maybe some still run UIWebView) have been made using this component (because App Store reviews enforce this), it’s clear that it has to provide extensive control over displayed contents.
- semiquaver 4y ago
  SFSafariViewController is available as a safer alternative. Presumably at some point apple will deprecate and remove WKWebView for precisely the reasons mentioned in this article.
  - manmal 4y ago
    I don’t think they’ll ever remove that, because a decent portion of apps serve HTML from the app bundle (many hybrid apps do nothing else infact) and SFSafariController can’t hide its chrome. Many hybrid apps do need the delegation methods WKWebView offers, which are already way more limited than UIWebView was.
    - xuki 4y ago
      This is a policy problem, not a technical one. They'll keep WKWebView around but only for non-browsing purpose. Anything that resembles a web browser, SFSafariController or rejection.
      - altairprime 4y ago
        That policy was recently hinted at here: https://developer.apple.com/news/?id=trjs0tcd https://developer.apple.com/news/?id=trjs0tcd But it hasn’t been enforced yet for big apps like Yelp and Instagram.
altairprime 4y ago
I’m wrong, and confused the older UIWebView with WKWebView.