News for hackers. Stuff that matters.
Re:Permission.site by gfxgirl on Friday March 26, 2021 @01:59AM (#26589154)
I'm so glad. I trust running whatsapp.com, messenger.com, slack.com, discord.com, bluejeans.com, zoom.com etc.. I do not trust installing the Whatsapp app, slack app, discord app, zoom app, or bluejeans app. In the browser I have control, native (at least on Windows) I don't. Those native apps, at least on windows, can basically do anything. Read my entire hard drive, scan my network, install a key logger, turn on my camera and mic, etc.... In the browser they can't
Re:Permission.site by 4gotunameagain on Friday March 26, 2021 @02:44AM (#26589400)
It's so frustrating that they deliberately make shitty web apps in order to force you to install an app on your phone (e.g. reddit, instagram)

It should be illegal imo

Re:Permission.site by DavidPeiffer on Friday March 26, 2021 @10:57AM (#26592918)
Facebook is the #1 offender in my opinion. I absolutely refuse to install any Facebook app. Back in the day, you could message people in the mobile browser without issue. Heck, it even loaded new messages without needing to refresh.

Then they decided you should need the app to message people.

Then they decided you should use a completely separate app to message people versus browse Facebook.

Now I have to use mbasic.facebook.com to message people. The quality of the experience dropped so much because, but I'm glad they don't have access to my contacts, text messages, location, etc. They get enough info about me from other sources.

Re:Permission.site by soverance on Friday March 26, 2021 @01:41PM (#26594838)
Yup, this exact timeline of degraded experience on Facebook led me to disable my account. I haven't reactivated it in over a year, and I'm happier for it.
Re:Permission.site by DavidPeiffer on Friday March 26, 2021 @02:12PM (#26595135)
What kills me is I recall the mobile browser experience being better in the 2012 era than 2021. We've moved from alright 3G to widely available 4G with populous areas having 5G, and with home internet connections generally being much faster. The same website code could provide a much better experience simply from more bandwidth availability. Instead we've regressed because everything needs an app now.

Some forum software allows the owners to create an app then prompts you to install their app. Not sure which it is, but it's super annoying.

Over the last couple, reddit has significantly limited their mobile website utility, requiring login (like Instagram) and nagging you to download the app.

Marketing metrics seem to have overcome usability in terms of relative importance. It's really frustrating to see what the movie computing environment has become.

Re:Permission.site by coding123 on Friday March 26, 2021 @01:57PM (#26595001)
I asked my dad to send me a picture of his shed recently. He asked if I have WhatsApp. I reminded him I don't use any social media. And he said, uh, it's going to be very hard for me to figure out how to send it without WhatsApp..

No shed picture. But no compromises here either.

Also I find it totally hilarious that I'm 42 and I have never even seen WhatsApp's interface yet my 80 year old father is a social media expert in a lot of ways.

Re:Permission.site by Teknoman117 on Friday March 26, 2021 @02:06PM (#26595087)
I've been mostly trying to get my friends and family onto Signal. I really want to ditch FB messenger.
Re:Permission.site by CyberRabbi on Friday March 26, 2021 @02:53AM (#26589439)
Yeah I agree with the spirit of that. There should be a name for that practice, something that makes it sound as bad as it is but catchy. Maybe, something like webhostaging. Reddit’s webapp on mobile is notorious for webhostaging you into downloading their native app. It’s literally unusable.

There should also be a name for ostensibly public social media sites that webhostage you into signing up. Instagram comes to mind.

It’s a reprehensible dark pattern.

Re:Permission.site by Y_Y on Friday March 26, 2021 @05:16AM (#26590131)
"webhostaging" is a much catchier name than the other suggestions in sibling comments, I think, and more memorable because it sounds weird (a bit like "webhosting"?).

It's so clever I think I'll start using it, and also telling people I came up with it by myself.

Re:Permission.site by CyberRabbi on Friday March 26, 2021 @12:47PM (#26594222)
It does sound too Much like web hosting and in that sense it’s a fail. Steal it all you want, I win if companies start feeling shame anyway.
Re:Permission.site by kubanczyk on Friday March 26, 2021 @04:31AM (#26589908)
Appforcing?

The industry term is "web-to-app conversion" by the way.

Re:Permission.site by CyberRabbi on Friday March 26, 2021 @12:59PM (#26594347)
I like this suggestion, I think it needs to be more catchy and roll off the tongue a bit easier. Here are some other suggestions:

Appholing Appstunting Nativebaiting

Re:Permission.site by prox on Friday March 26, 2021 @05:06AM (#26590086)
Webcrapp

Has both web and app in it, and it says what it does. Could also be webcrapping as verb.

Re:Permission.site by CyberRabbi on Friday March 26, 2021 @12:50PM (#26594248)
I think a verb-oriented word is more powerful at shaming than a noun-oriented word. I think Crap is a little too vulgar to appeal to most people, some might feel uncomfortable at work saying crap for Instance. But try it out!
Re:Permission.site by _Qeomash_ on Friday March 26, 2021 @04:22AM (#26589864)
App + Oppression = Appression
Re:Permission.site by egeozcan on Friday March 26, 2021 @03:10AM (#26589533)
Maybe webhijacking? Maybe I should purchase a domain and document it... Who knows, maybe it catches on and people start linking to it.
Re:Permission.site by CyberRabbi on Friday March 26, 2021 @03:12AM (#26589539)
Yes there needs to be a single use site for this. Everyone is familiar with this , it just needs a catchy name so people on Twitter spread this and easily shame websites en masse for doing it. Webhijacking is too similar to webjacking IMO https://www.geeksforgeeks.org/web-jacking/
Re:Permission.site by egeozcan on Friday March 26, 2021 @05:45AM (#26590284)
I knew it sounded familiar from somewhere, thanks! :)
Re:Permission.site by lima on Friday March 26, 2021 @06:02AM (#26590369)
Slack, too. Slack has a perfectly good workspace sidebar in their web app, but they hide it unless you're on a Chromebook (where you can't install their native app).
Re:Permission.site by spockz on Friday March 26, 2021 @06:26AM (#26590465)
Can you spoof the user agent to get it to show?
Re:Permission.site by lima on Friday March 26, 2021 @03:07PM (#26595717)
Yes. There's a Chrome extension that does it and a couple user scripts: https://webapps.stackexchange.com/questions/144258/slacks-we...
Re:Permission.site by bierjunge on Friday March 26, 2021 @07:19AM (#26590750)
Depends on your Chromebook, I have a Acer R13 and it's installed and running (just checked it). Android app's don't have a designated "runs on Chromebook" Flag as far I know, so you can't really block it.

But Chromebooks are sometimes a little bit special. I'm working on a app right now which is designed for tablets and wanted to check if I could run it on my Chromebook, because of the bigger screen (13" compared to Samsung S5/S6 with ~10") and I couldn't install it from the alpha channel. The thing was, it has a camera, a front camera, but the Manifest.xml required the default camera permission which was missing and this prevented me from even finding the app in the PlayStore.

And Slack as app is basically only the website. All the "native" apps seem to just render it (Linux, MacOs and Windows are Electron apps, the Android version feels like a WebView)

Re:Permission.site by jooize on Friday March 26, 2021 @06:25AM (#26590460)
Does spoofing user agent help?
Re:Permission.site by rplnt on Friday March 26, 2021 @05:42AM (#26590261)
I'm fairly certain Jira does this as well. At least the first step of making the web app deliberately shitty.
Re:Permission.site by nicoburns on Friday March 26, 2021 @06:34AM (#26590509)
JIRA just has poor-quality engineering all round. Their native apps are just as bad.
Re:Permission.site by KptMarchewa on Friday March 26, 2021 @04:56AM (#26590028)
At least reddit allows third party apps.
Re:Permission.site by malikNF on Friday March 26, 2021 @05:23AM (#26590157)
Well how long before they tell us they are "a very different company" [1] and decide to pull the plug on 3rd party apps.

[1]https://www.reddit.com/r/changelog/comments/6xfyfg/an_update...

Re:Permission.site by krtkush on Friday March 26, 2021 @06:11AM (#26590401)
I think the eventual limitations on 3rd party apps are coming. A major part of the community has used/ is using the superior 3rd party alternatives, and they need to figure out how to nullify those advantages. It is inevitable because they want that sweet advertisement money for which 3rd party apps are a barrier.
Re:Permission.site by brianzelip on Friday March 26, 2021 @06:58AM (#26590634)
See everything google related.
Re:Permission.site by toastal on Friday March 26, 2021 @08:08AM (#26591081)
It's a shame Firefox just ditched the SSB project instead of fixing the bugs and making it visible for PWA use. They say it's because people weren't using it, but it was another thing that was hidden behind about:config and had some glaring bugs which two strong reasons why people probably weren't using or even know about it.
Re:Permission.site by chronogram on Friday March 26, 2021 @02:11AM (#26589220)
Indeed. They're sandboxed and you can alter the webapps in the browser. I mildly edit the CSS of most of the websites I frequently use over time with Stylus.
Re:Permission.site by VWWHFSfQ on Friday March 26, 2021 @02:18AM (#26589257)
As long as those apps will run in my web browser, I'll run them there. I don't install any of their "native" apps.. Although Google Meet is getting very difficult to run in Firefox. Crashes all the time.
Re:Permission.site by padenot on Friday March 26, 2021 @03:59AM (#26589732)
Can you give us a couple of these crashes, that you can find in about:crashes (with the date sometimes its easy to find the right one) ?

If you send a link to [email protected] I can have a look, I'm on the media team at Mozilla (that includes WebRTC).

Thanks!

Re:Permission.site by VWWHFSfQ on Wednesday March 31, 2021 @05:35PM (#26653460)
I'm going to try to capture a crash report and send it to you.

I should note that it's not a "crash" -- it's just that I get immediately disconnected from the meeting when I have my video + audio on and then someone else joins. I'll try to get some repro steps and send to you!

Re:Permission.site by lrem on Friday March 26, 2021 @03:43AM (#26589666)
Works fine in my Firefox... And does Google even offer native PC apps any more? I work there and haven't heard of such a thing.
Re:Permission.site by rplnt on Friday March 26, 2021 @05:39AM (#26590239)
Drive and Photos have native apps, for obvious reasons (sync).
Re:Permission.site by skrtskrt on Friday March 26, 2021 @09:51AM (#26592121)
Doesn't google meet not have a native app? We use Google Meet at work and using a browser to screen share a browser or IDE window seems to absolutely peg my CPU no matter which browser I use.

I have no love for Zoom but at least they have a desktop app so I can screen share without bogging down my whole machine

Re:Permission.site by Teknoman117 on Friday March 26, 2021 @02:09PM (#26595113)
Google meet crashing is interesting. I use it literally every day for meetings and I run Firefox as my primary browser (on Linux though, if that matters). I can't recall ever having a crash from it.
Re:Permission.site by sneak on Friday March 26, 2021 @02:31AM (#26589320)
I ran into the issue recently where Zoom's web client wouldn't display my camera's correct aspect ratio. Their full client (on a burner laptop, don't trust them) had a setting to fix it.
Re:Permission.site by tjoff on Friday March 26, 2021 @02:54AM (#26589446)
Yeah, lucky you for running six(!) different messaging apps that you do do not trust.

The future is just tragic.

Re:Permission.site by danenania on Friday March 26, 2021 @12:48PM (#26594233)
It’s true that installing a native app requires a lot of trust, but on the other side of the coin, it’s not currently possible to do end-to-end encryption securely in a web app, and content in web apps is vulnerable to browser extensions with blanket permissions (there are many ubiquitous ones). Web apps also don’t have access to the OS keychain or any ability to set file permissions, meaning they can’t store local data securely without help from a server.

So if you want real data privacy, you need a native app, despite the drawbacks you point out.

Re:Permission.site by dillondoyle on Friday March 26, 2021 @01:19PM (#26594599)
You probably could with WASM? Totally create your own stack 100%.

And there are already encrypted media streams but I don't know if that counts as E2E?

A lot of these 'native' apps are just web browsers anyways...

Re:Permission.site by danenania on Friday March 26, 2021 @01:43PM (#26594869)
The key difference is running a signed, static bundle of code (or binary), rather than a bunch of code that is loaded dynamically from a server on every request, which can be modified without leaving any trace.

So running WASM wouldn't make any difference if you're relying on a server to deliver you that WASM on every request. A compromised (or subpoenaed) server could simply ship you a compromised WASM payload for a single request and you'd be extremely unlikely to ever find out. If Signal wanted to add a backdoor, otoh, they'd need to ship it as a signed update to all their users, with all the reputation risk that entails.

Whether a native app is simply a browser underneath doesn't matter, just how the code gets delivered to the user. Even a browser extension or chrome app could work, since they are run from a signed, static bundle rather than from a server.

Encrypted media streams seem like a DRM feature? I don't think they have any relevance to end-to-end encryption.

Re:Permission.site by dreamer7 on Friday March 26, 2021 @08:21AM (#26591193)
I completely agree. MacOS, atleast since Catalina, has been seeking more specific permissions for apps which is good.

One particular video conferencing software asked for permission to read key strokes from any process! A very weird request. The only non-nefarious use case I can think of is that they want to allow keyboard shortcuts to work even when their app isn't in the foreground.

Re:Permission.site by jefftk on Friday March 26, 2021 @10:45AM (#26592760)
Another potential non-nefarious use case would be to make push to talk work when it's not in the foreground?
Re:Permission.site by dreamer7 on Friday March 26, 2021 @11:10AM (#26593061)
That seems really problematic though. I could be on a text editor, or the terminal or anywhere else requiring text input and might not be expecting this behaviour.
Re:Permission.site by jefftk on Friday March 26, 2021 @11:25AM (#26593214)
Sorry, I edited my comment not to say spacebar, since space clearly wouldn't work.

On the other hand, you might be able to do it with some key or combination that is less commonly used?

Re:Permission.site by aleclarsoniv on Friday March 26, 2021 @11:46AM (#26593464)
I don't get why Apple doesn't provide an API for registering global key bindings. All it needs is user permission for a binding to be registered, and some kind of preference pane that shows you an overview of registered bindings.
Re:Permission.site by CamJN on Saturday March 27, 2021 @01:16AM (#26600108)
They do.
Re:Permission.site by vplaunch on Friday March 26, 2021 @05:48AM (#26590301)
They can't? There's a setting in Firefox "Block new requests asking to access your camera" that you have to enable explicitly.

I'd rather have a browser that cannot access these things at all. Now I've to hope that the permissions work and the implementation is bug-free (my trust in that is quite low, browsers are too large).

Re:Permission.site by randallsquared on Friday March 26, 2021 @06:04AM (#26590378)
If you don't select that setting, is the default to always allow, or ask every time? If the latter, then the setting is just a convenience for those who always expect to select "deny", rather than any broadening of permissions.
Re:Permission.site by pabs3 on Friday March 26, 2021 @07:40AM (#26590877)
I'd much rather open source native apps than open source or proprietary web apps (or proprietary native apps).
Re:Permission.site by gingerlime on Friday March 26, 2021 @05:05AM (#26590075)
I wonder if it’s possible to install an ad blocker, at least on the electron-based apps? and regain that control?
Re:Permission.site by input_sh on Friday March 26, 2021 @05:53AM (#26590324)
CSS-based, no.

But you can put your computer behind Pi-hole or add some of Pi-hole's lists to your hosts file, which would prevent them from communicating with tracking domains completely... unless they also bundle some sort of a proxy or a VPN.

Re:Permission.site by gingerlime on Friday March 26, 2021 @06:39AM (#26590537)
Yeah, I'm already using nextdns, but not sure it's enough in some cases...
Re:Permission.site by mavhc on Friday March 26, 2021 @04:13AM (#26589815)
whatsapp, messenger, slack and discord are all just electron, so almost identical anyway. Zoom has extra desktop features. Teams is has slightly more stuff on desktop, and it's electron.
Re:Permission.site by lokedhs on Friday March 26, 2021 @04:33AM (#26589915)
Unless you're on Linux. Teams web application allows you to share individual windows, but this feature is now available in the application.