iOS allows apps to read browser history.(maybe?) Entire internet doesn’t notice | Hacker News Reader

iOS allows apps to read browser history.(maybe?) Entire internet doesn’t notice

26 pointswtaf-people18 comments

IOS allows apps to read your browsing history outside the app.

There seems to be a consensus that this is impossible. There’s nothing about this on the entire internet. I could not believe it when I saw it, but it’s plain as day. When I asked Apple support for clarification, even the rep was under the impression that Apple would never allow this, until I sent a screenshot. I still cannot believe I’m the one pointing this out. WTF?

https://apps.apple.com/story/id1539235847

“Browsing history Information about the content you have viewed that is not part of the app, such as websites“

This is in hundreds of iOS apps, such as PayPal. Welcome to the future, I guess.

Edit: Apple Support was unable to get to the bottom of this so I appreciate any info

Edit: Apologies for the dramatic title, I should have made this an ask.

Either way, Apple really should have thought this through more when writing the description.

This is saying "if an app opens a webview, the app can monitor your browsing activity inside that webview."

It is written vaguely and should be re-written to be precise, but as they are going for "end user" language here I can understand that it is hard to communicate to non-technical users that "embedded browser" and "browser" are different things given that they have similar UX and similar functionality.

A common use case of an embedded webview is an app that uses a website for some portion of a user flow, IME this is typically when there is a B2B2C business relationship. I think it can also happen for an OAuth2 integration but I'd expect there are some iOS native SDKs that are preferred. IME, many businesses use "web SDKs" instead of native libraries, and their integration guide will say something like "have your app open a webview to URL X, then user does Y as we have agreed, then we will close the webview" (occasionally, a few will use hooks in the webview to communicate result information to the native app).

That was my original assumption but how can you be so sure? I think you’re being too hopeful here.

Also calling webview “outside the app” is a bit of a stretch

Not a stretch at all, it is perfectly reasonable to consider an app and an website embedded by the app as two completely different things. First there is no guarantee the WebView will open to a website owned/operated by the same entity that owns/operates the app, so it is definitely "outside the app". From the user's privacy perspective, you also want to communicate that just because the website might be branded "Facebook" and be run by Facebook and maybe you trust FB with your messages, but if it's an embedded browser opened via a WebView then the app can technically snoop on the private message you are typing into the WebView

I think you’re right but they really need to update the description for this

It doesn’t say “outside of the app”. It says “information about the content you have viewed, which is not part of the app, such as websites”, which is completely different.

This category exists for apps that embed a webview.

Safari is sandboxed. There is no way to get to its data like history.

[edit: I re-read the text, this is literally saying "if an app has/is a browser then it can record what sites you go to", which is something that any browser could do]

Safari supports extensions, extension are deployed as apps. It goes without saying that a browser extension can see what pages you visit (and so build up your browsing history).

It's also not "any app", this is where the App Store does its thing: to be able to do certain actions (like connecting to safari) the binary has to be provisioned with the correct sandbox entitlement - this is enforced by the code signing logic built into the kernel: the set of entitlements is part of the signed data, so any entitlements an app tries to get have to be approved (and so signed) by the App Store.

"this is literally saying “if an app has/is a browser then it can record what sites you go to"”

Except it literally doesn’t say that literally

Think about the fact that if you are wrong, it would say exactly what it says, and (as seen in this thread) everyone will assume it means webview

Ok, I need to be clear here: this is absolutely not saying an app can access the browsing history in safari, nor can it access the browsing history of any app.

It can very obviously record your browsing history in that app. If it sends that data to its home servers, then the app would have to declare that it collected "browsing history".

"Information about the content you have viewed that is not part of the app, such as websites."

that is it can record things other than you interacting with buttons in the app, or what type of music you're listening to, etc. Browsing history gets called at explicitly here because people using non-chrome browsers expect browsing history to be private.

You solved the puzzle I think. The wording was designed specifically for browser apps. They didn’t anticipate non-browsing apps to be using webview. Also I was exaggerating when I said hundreds of apps. Seeing it on PayPal is what threw me off

I think it means the links that you open in the app which are opened in a browser “layer” on top of the app. Something like when you wanna sign in to Google on iOS’ Gmail app and the pop up shows up for you to enter your username and password.

[edit: I re-read the text and I think this is as you say: if an app has/is a browser, then that app obviously knows your browsing history]

Nope, its extensions :)

Just using a WebView doesn't give you any safari data, and if you're using a UISafariView or whatever its called I think its basically an opaque view with limited accessible data (and the view itself is running in another process)

Many of the things listed here are gated behind OS permissions. Is there a reason to think the browser history is not?

Also: some apps include webviews. It makes sense that those would be able to see what you do inside those webviews. Is it possible it's just using broad language to describe this case?

I suppose “not part of the app” could mean webview, but I doubt it. It seems pretty clear here. You’d think they would have a strong interest in specifying otherwise, if this isn’t the case.

Also has anyone ever had the OS ask for permission on this?

There is no permission or api to ask for this. It is not possible.

Wow, glad I only use private mode on Safari on my iDevice since Apple wanted access to all my cookies. Does this perhaps have to do only with Safari browser extension apps? Can some ios developers chime in with the actual API that allows this?

I have been saying this is the safari extension api, but on rereading I think its trying to say "if you're using a browser, the browser knows your browsing history"

Upon further thought, without arguing what the words mean, it would make sense that PayPal would be using a browser since the entire UI is basically the mobile site

iOS allows apps to access your camera and see inside your house.

Reply on news.ycombinator.com