In-App Browsers: The worst erosion of user choice you haven't heard of | Hacker News Reader

In-App Browsers: The worst erosion of user choice you haven't heard of

open-web-advocacy.org

63 pointsmarban20 comments

This seems like a clear cut case of a missing permission: for an app to be allowed to access your interactions with a domain, it should need to either prove it owns the domain, or receive user permission to access the domain. This safely covers the legitimate use cases of punting out some UI to your website and of just providing a way to view websites in-app, while for iffier use cases permitting both informed consent and fallback to displaying the page without handing out access to it.

Alex Russell wrote a more in-depth article about the issue back in 2021[0]. I don't think the landscape on this end has significantly changed much, since what's said in the article is still mostly relevant these days.

That said, do keep in mind he's not unbiased; he's a PM at Microsoft for Edge and used to work on Chrome. Nowadays he's also one of the Blink API Owners (he approves new Blink Web API features). Most of his writing on the state of the browser market is solid, just know that he's obviously got an angle and arguably is also responsible for the modern Blink monoculture.

[0]: https://infrequently.org/2021/07/hobsons-browser/

I would love if this were implemented. For one thing it would prevent insane App Store rejections like [this](https://mastodon.social/@vandal/112167322002780991) which actively requires using an in-app browser. I wish there were a setting to never use an in app web browser on iOS.

> I wish there were a setting to never use an in app web browser on iOS.

I get that, but by the same token, a thoughtful app maker can provide that option to you today (I have apps on my device that expicitly have that option).

Honestly, if this rule were in place, that App Store rejection would make even /more/ sense — it’s even /more/ cumbersome to stitch together a login flow by redirecting to another entirely separate app (the default browser).

facebook on android has a toggle to use their in app webview or system browser.

EXCEPT IT DOESNT WORK

i.e. you can toggle it on recent clients and it does nothing.

If you install an old version (I think i used summer 2023, but might have been even older). It does work and does stick when you upgrade.

it has been this way for months: https://xdaforums.com/t/guide-force-facebook-app-to-open-lin...

Funny. As I started reading your comment, I reacted with a big "wow, Facebook would actually offer that option?"

Then I reached your "but it doesn't work".

Happy everything became normal again :)

These days I feel like spider man swinging from in app browser to safari to another in app browser to open in app. Sometimes switching 3-4 browsers before getting to my destination. Absolutely ridiculous, and should certainly be eliminated.

I doubt most users care enough (even if this is a real issue). So it seems like the only way this practice could be mitigated is if it somehow is unaligned with OS vendors' (apple, android) interests.

Like, maybe it harms Apple's reputation as privacy champions, or creates security vulnerabilities or something

Users get frustrated often enough that links aren't opening in the correct app.

I would expect iOS/macos to put up a big red badge when the webkit currently being viewed is not sandboxed by the O/S.

> Apple must update SFSafariViewController (Apple’s system provided in-app browser for iOS) to respect the user's choice of default browser.

I don’t understand this ask. If the idea is that in-app browsers are inherently compromised either through security or user preference, then at that point it makes no sense for an in-browser component to exist in the first place; all it’s going to do is invisibly bounce the request from the app to the default browser, at which point the app might as well just invoke the default browser directly and not bother using the in-app version.

Changing to external browser in the Discord Android app apparently opens all links in Chrome only. So not exactly a choice.

I despise that apps are allowed to do this without clear consent or very good reasons.

The main problem is that there are no browser extensions for mobile browsers.

Firefox on Android :)

Brave works if you just want adblock and youtube playback even on iOS!

Then there are the offshoots like Kiwi browser that has the Chrome extension store!

Even Samsung and Edge on Android atleast has Adblock plus that can be enabled but obviously not as good as ublock origin on Firefox.

What about Orion on iOS or Firefox on Android? Both allow extensions

Safari on iOS supports extensions, and - while I don't know - I'd be shocked if Chrome on Android didn't?

Chrome does not.

But we can install alternatives that are better.

You can run Ublock Origin on Kagi's Orion browser on iOS, even though it is webkit.

Also eroding user choice:

- in-app file browsers (garbage stock dialog from operating system, not your favorite commander)

- in-app text editors (stock text input widget; not your favorite editor)

- in-app programming languages (Javascript, VB ..., rarely Lisp)

Let's complain about everything while we are at it!

Reply on news.ycombinator.com