I don't think there's anything stopping web browsers to have the same level of privacy features as the apps, is there? Apple, Google and Microsoft owns both the OS and the browser, so there's really no excuse I feel.
I don’t see how you could replicate blocking all network access with a website. Websites inherently communicate with a remote server which limits privacy guarantees.
With the exception of either investing time into targeted request black-holing or disallowing apps from contacting the outside world entirely (which would produce a pretty crappy AirBnB experience) I don't think this is really reasonable. Most useful apps have some legitimate reasons to talk to servers so blocking access before the app can get it (similar to how browsers block access before the site can get it) seems like the most reasonable approach. And websites don't need to inherently communicate with a remote server - there are a bunch of web tools out there that download a bunch of JS and then essentially run in local mode without ever sending that data home... yes the original stuff is coming from a foreign source but that's the same as Apps - the acquisition method is just different (and a lot more prone to abuse I'll grant you).
However, pretty much every useful app you're using is calling home for some moderately legitimate reason - so I don't think it's helpful to differentiate the two classes of executables based on remote asset usage.
The majority of Apps on my phone have zero reason to communicate to the outside world. A calculator, standalone game, etc should function without network access and if it doesn’t then delete the app and get something useful when the network is down.
Honestly, if I can’t block network access I don’t see the value in downloading a AirBnB app or just about any other app companies want me to install.
How would web protocols allow for more privacy? If Safari implemented all the Chrome PWA APIs it would open up the user to far more browser fingerprinting while also increasing the attack surface.
Also every crappy website will think it’s okay to force download a huge PWA payload and fill the phone up with notification spam. No thanks.
Not sure how the protocols themselves help, but at least for now, we still have things like content blockers and extensions for mobile web browsers.
Native apps have more freedom to do whatever they want, and they do it more opaquely. I guess the only thing that comes close to a web browser content blocker for iOS native apps is piping your traffic through one of those ad-blocker VPN apps like Lockdown, which sucks.
Of course, nothing compares to the amount of insight you have into websites on a desktop web browser where you can open a networking tab in the dev tools.
Web VR is being routinely used to add fingerprinting and tracking. Direct access to USB devices adds so many vectors for abuse I can't even imagine how it will end up being mis-used.
> If Safari implemented all the Chrome PWA APIs it would open up the user to far more browser fingerprinting while also increasing the attack surface.
Surely the answer is "so Safari shouldn't implement those APIs"? It's app makers who think we need constant push notifications from everyone; by and large they're subtractions rather than additions.
