Hacker News Reader

Apps that use Safari View Controller cannot view the page - of course Facebook doesn't use SVC for this reason.

While you're right that the Facebook/Instagram app can spy on links opened within the app, it can't plant cookies in your web browser - so those go both ways.

View on HN

I thought Facebook/Instagram used a WebView for their in-app browser on both iOS and Android? Which means they can do anything they want, including exfiltrate your browsing.

I meant "of course Facebook doesn't [use Safari View Controller]". WebView ≠ Safari View Controller.

Safari View Controller keeps the users cookies from Safari and prevents this behavior. For most apps, keeping users logged in without leaving the app is preferred, so they give up the ability to inspect the contents of the page.

Sorry, rereading your comment that's exactly what you said and I just misread!

> Safari View Controller keeps the users cookies from Safari

It does not, because apps decided to abuse it for fingerprinting.

GP a was referring to a specific “web view” implementation that offers an almost-complete browser implementation and security on iOS. Facebook does not use this but a regular WebView

Reply on news.ycombinator.com