News for hackers. Stuff that matters.
Re:Apple confirms it's breaking iPhone web apps in the EU on... by secondcoming on Thursday February 15, 2024 @04:16PM (#39389006)
> malicious web apps could read data from other web apps and recapture their permissions to gain access to a user’s camera, microphone or location without a user’s consent.

How is this even possible? It's shocking that these APIs even exist for any browser to use.

Re:Apple confirms it's breaking iPhone web apps in the EU on... by kemayo on Thursday February 15, 2024 @04:23PM (#39389102)
I assume you mean the "read data from other web apps" part. That'd be because there's (presumably) not a system-level way to launch a third-party browser in "web app mode", with all data siloed off per-PWA. Thus the only way they could currently make web apps work would be to launch the third-party browser and trust that it silos everything adequately itself internally.

Apple could add a bunch of new APIs to support this case for third-party browsers. Presumably there's something equivalent that's being done for said web apps currently in Safari. But they're not wrong to say that there's not an existing system in place that said third-party browsers are already written to use. (And, you know, they're clearly not invested in trying to make this law succeed.)

Re:Apple confirms it's breaking iPhone web apps in the EU on... by fock on Thursday February 15, 2024 @06:03PM (#39390497)
the bunch of new APIs might just be a containerized copy of the users browser? Seems very easy.
Re:Apple confirms it's breaking iPhone web apps in the EU on... by kemayo on Thursday February 15, 2024 @07:01PM (#39391100)
I think there's a lot of edge cases, and just spinning up an entire new data container for iOS Chrome and launching a web app inside it would probably make Chrome very confused. (It wouldn't know to hide its normal tab/browser UI, to not nag the user about logging into their google account, etc.)

Like I said, Apple could totally make APIs so that Chrome could know it was being launched in a container with data isolation and should behave as a web app. Google could then adopt those APIs, with the alacrity that it's famous for showing with new iOS system APIs. But the behavior Apple is implementing here is probably how any default-browser that hadn't yet opted into those new APIs would have to behave.

(To be clear: I think Apple is being petty here by not having those APIs announced. But "we're going to regress everything to bookmarks" is probably more DMA-compliant than "things are better when you use Safari, and we promise we'll extend that to other browsers someday".)

Re:Apple confirms it's breaking iPhone web apps in the EU on... by jquery on Thursday February 15, 2024 @08:30PM (#39391911)
Bookmarks are superior to PWAs, anything that reduces the spread of PWAs is a good thing in my opinion.
Re:Apple confirms it's breaking iPhone web apps in the EU on... by jwells89 on Thursday February 15, 2024 @07:09PM (#39391180)
Currently Safari on Mac copies over login cookies and data directly relevant to the site and nothing else when installing an app as a PWA.

This strikes me as the way to go, there’s no good reason for anything else to be copied and it reduces the amount of data that integrated privacy-compromising ad and analytics services can readily glean from users.

Re:Apple confirms it's breaking iPhone web apps in the EU on... by amelius on Thursday February 15, 2024 @04:20PM (#39389055)
I didn't read the article, but to me it sounds like Safari's security mechanisms need more work.
Re:Apple confirms it's breaking iPhone web apps in the EU on... by MBCook on Thursday February 15, 2024 @04:31PM (#39389216)
Safari is fine.

Other browsers would have to be trusted, Apple doesn’t have a mechanism to ensure that they do what they’re supposed to.

So until they have time to add one (remember they already had to create all the API‘s for third-party browsers to use), they’re not allowed to give Safari preferential treatment. So they had to remove the feature.

Re:Apple confirms it's breaking iPhone web apps in the EU on... by zer00eyz on Thursday February 15, 2024 @04:18PM (#39389032)
>> How is this even possible? It's shocking that these APIs even exist for any browser to use.

https://www.theverge.com/24054329/microsoft-edge-automatic-c...

Ask MS, they already did it.

Re:Apple confirms it's breaking iPhone web apps in the EU on... by veeti on Thursday February 15, 2024 @04:45PM (#39389432)
This is completely irrelevant to the discussion, there is no sandboxing on PC.
Re:Apple confirms it's breaking iPhone web apps in the EU on... by cqqxo4zV46cp on Thursday February 15, 2024 @05:03PM (#39389727)
iOS and Windows’ security models are not remotely comparable. I can’t imagine that you’d be making such intellectually lazy comparisons if it wasn’t in the context of some perceived holy war.