7 ms·
If an app needs a webview, it should always strive to open that view in an embedded Safari webview (called an SFSafariViewController) or link to the view in the
by null_object 4y ago
If an app needs a webview, it should always strive to open that view in an embedded Safari webview (called an SFSafariViewController) or link to the view in the user's own choice of browser.
The app is prevented from seeing ‘inside’ this view.
Sometimes an app needs to control some aspect of the external view - for instance listen to some Js event, or inject authorization - and this can be for totally legitimate reasons in the flow of the app. Then the application needs to use another type of embedded webview called a WKWebView, which by definition allows the app to see into the user's interactions in the embedded browser.
Most developers and apps use these for totally necessary reasons - but Facebook is deviously abusing this functionality.
Some of the posters in this thread are blaming Apple for Facebook's evil behavior, but a lot of totally legitimate functionality that needs this type of app/browser communication would be impossible without the ability to enable it for genuine and well-founded reasons.
- mooman219 4y agoIf "skirting Apple privacy rules" amounts to opening a web link, then it absolutely is Apple's fault. If Apple provided SFNextPaymentsInformationExporter, and a malicious app used that nefariously, and then the app was approved, that's entirely on Apple. If Apple wants to advertise security and privacy, as well as enforcing App reviews, then I consider that to be enough to hold them accountable if they fail their advertised promise. Apple did not respond by removing the offending app from their store either.