Top all-time · #1861
Felix Krause
Personal blog · krausefx.com/blogsecurityprogramming
Felix Krause's personal blog at krausefx.com covers security and programming. Since 2015, 39 different Hacker News readers have linked it 57 times, most often “See what JavaScript commands get injected through an in-app browser”. It is still writing: the last post was on 2026-05-02, and you can follow it by feed.
Too few sampled comments (19) to say how often HN recommends it.?
Why HN links it
HN readers link Felix Krause's posts on iOS privacy, including in-app browsers injecting trackers, app sensor data, and developer tooling, usually as supporting evidence.
- Recommended for · 1 comments
- Commenter was very impressed by the author collecting years of personal data and sharing his learnings publicly.
Summarised by Claude from a sample of 19 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Personal website and blog of Felix Krause
Most-linked posts?
- See what JavaScript commands get injected through an in-app browser5 people · 7 mentions · first linked 2022-08-18
- Attacks against iOS third party SDKs4 people · 4 mentions · first linked 2018-02-15
- Inappbrowser.com – see what JavaScript gets injected through an in-app browser3 people · 4 mentions · first linked 2022-08-19
- Instagram can track anything you do on any website in their in-app browser3 people · 3 mentions · first linked 2022-08-10
- iOS Privacy: Easily get a user's Apple ID password, just by asking3 people · 3 mentions · first linked 2017-10-10
- Fastlane is joining Google3 people · 3 mentions · first linked 2017-01-23
- Continuous delivery for your profile picture2 people · 2 mentions · first linked 2018-12-30
- Felix Krause leaves Google and steps away from Fastlane2 people · 2 mentions · first linked 2019-02-13
What Hacker News says?
Don't many apps use their own in app browser and not Safari? https://krausefx.com/blog/announcing-inappbrowsercom-see-wha... I always thought that a company should make an app those does something trivially, but also has its own in app browser as the true functionality.
Comment linking /blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser
on “US developers can offer non-app store purchasing, Apple still collect commission”Submitted Instagram can track anything you do on any website in their in-app browser as a story · 1258 points
HN discussion>Characterizing device information and IP addresses as "privacy violations" is a stretch. I agree: this is a characterization I never made. FYI, I also collect this type of data about you when you visit my website. That said, telemetry + totalitarianism = bad combo. >Irrelevant. The data collection is done by first parties. Encryption doesn't do anything. Even if data is collected by first parties, encryption is sti…
Comment linking /blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser
on “OpenAI says it has evidence DeepSeek used its model to train competitor”Submitted iOS Privacy: Easily get a user's Apple ID password, just by asking as a story · 867 points
HN discussionAuthor here = I actually researched & published many privacy projects ( https://krausefx.com/privacy ), and deeply care about being in control over your data, and being explicit about what you choose to share. - The data is stored in my own, private database, not connected to any service - Much of the data visualised on that page, is data many larger companies already have about you. I figured, why wouldn't I want t…
Comment linking /privacy
on “I put my whole life into a single database”Submitted See what JavaScript commands get injected through an in-app browser as a story · 763 points
HN discussionAuthor here. I actually researched & published many privacy projects ( https://krausefx.com/privacy ), and deeply care about being in control over your data, and being explicit about what you choose to share. - The data is stored in my own, private database, not connected to any service - Much of the data visualised on that page, is data many larger companies already have about you. I figured, why wouldn't I want to…
Comment linking /privacy
on “I put my whole life into a single database”Submitted Sandboxed Mac apps can record screen any time without you knowing as a story · 706 points
HN discussionYes, there are ways to distinguish between them as a user, for example you can check to see if your browser plugins are available. I also went through some of the most popular iOS apps and created a list of which app uses the correct SFSafariViewController vs the potentially malicious WKWebView. - https://krausefx.com/blog/ios-privacy-instagram-and-facebook... - https://krausefx.com/blog/announcing-inappbrowsercom-s…
Comment linking /blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser
on “How did Facebook intercept their competitor's encrypted mobile app traffic?”Submitted I put my whole life into a single database as a story · 515 points
HN discussionTake a look: https://krausefx.com/blog/ios-privacy-instagram-and-facebook...
Comment linking /blog/ios-privacy-instagram-and-facebook-can-track-anything-you-do-on-any-website-in-their-in-app-browser
on “How did Facebook intercept their competitor's encrypted mobile app traffic?”Submitted Inappbrowser.com – see what JavaScript gets injected through an in-app browser as a story · 93 points
HN discussionMeta uses the in app browsers to inject trackers on every site you visit. https://krausefx.com//blog/ios-privacy-instagram-and-faceboo... Probably others doing the same. I always open pages in full safari and use NextDns to block trackers in all apps.
Comment linking //blog/ios-privacy-instagram-and-facebook-can-track-anything-you-do-on-any-website-in-their-in-app-browser
on “uBlock Origin Lite in Apple App Store”Submitted Attacks against iOS third party SDKs as a story · 7 points
HN discussionOn iOS, it used to be the case ( https://krausefx.com/blog/ios-privacy-whats-the-user-doing ), however with iOS 13 ( https://github.com/w3c/deviceorientation/issues/57#issuecomm... ) this has been addressed.
Comment linking /blog/ios-privacy-whats-the-user-doing
on “iPhone apps can tell many things about you through the accelerometer”Submitted Every iOS app you ever grant camera access can record you any time it runs as a story · 7 points
HN discussionIt doesn't solve all the problems, the status bar can be hidden or faked unfortunately https://krausefx.com/blog/ios-privacy-watchuser-access-both-...
Comment linking /blog/ios-privacy-watchuser-access-both-iphone-cameras-any-time-your-app-is-running
on “Facebook is using the iPhone’s camera as users scroll their feed”Submitted We used LLMs to help us find the perfect piece of land for our home as a story · 5 points
HN discussionI was very impressed by Felix Krause, who collected more than 380.000 data points over 3 years about his life in a single database and shared many of his learnings publicly: https://krausefx.com/blog/how-i-put-my-whole-life-into-a-sin...
Comment linking /blog/how-i-put-my-whole-life-into-a-single-database
on “Life Monitor”Submitted OpenClaw – My Automation Setup as a story · 4 points
HN discussionYes. It is exactly that. [0] [1] [2] [3] [4] [5] I thought Facebook was worse, but looking at TikTok, it takes the most invasive spyware crown. At this point if the solution is to outlaw all invasive tracking for all companies, the first thing to do is like how Facebook got a multi-billion dollar fine by the FTC, TikTok (and repeat offenders) must be fined in the tens of billions , if they want to continue operating…
Comment linking /blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser
on “TikTok Parent ByteDance Sees Losses Swell in Push for Growth”Submitted InAppBrowser: What JavaScript commands get injected through an in-app browser as a story · 3 points
HN discussionActually, right now, neither Google Chrome, nor Safari would warn the user at all, if you download ANY content via HTTP from a HTTPs encrypted website, it's a bug I filed for both browsers, but they didn't get resolved yet. I wrote in more depth about this topic over her https://krausefx.com/blog/trusting-sdks
Comment linking /blog/trusting-sdks
on “Blocking high-risk non-secure downloads”Submitted In-App browsers allow iOS app devs to steal user credentials and inject ads as a story · 3 points
HN discussion> Agreed. Rarely has a negative word about any Apple product been written on Daring Fireball. I pulled these from the front page of DF today, 2017-10-18. While John Gruber clearly writes an abundance of positive Apple stories, your charactarization is inaccurate. THE IMPOSSIBLE DREAM OF USB-C > USB-C is a dual disaster… Now that all modern Apple MacBooks are USB-C-only, USB-C’s problems are MacBook problems, too. ht…
Comment linking /blog/ios-privacy-stealpassword-easily-get-the-users-apple-id-password-just-by-asking
on “‘MAYBE IT’S a PIECE OF DUST’”Submitted Fastlane is joining Google as a story · 3 points
HN discussionOrignal blogpost: https://krausefx.com/blog/ios-privacy-stealpassword-easily-g... Discussion: https://news.ycombinator.com/item?id=15441537
Comment linking /blog/ios-privacy-stealpassword-easily-get-the-users-apple-id-password-just-by-asking
on “Stealing the password from an Apple account is surprisingly easy for a developer”Submitted Writing automated tests for your documentation as a story · 3 points
HN discussionFor context, fastlane is “a tool for iOS and Android developers to automate tedious tasks like generating screenshots, dealing with provisioning profiles, and releasing your application.” https://github.com/fastlane/fastlane Google seems to have acquired(?) it in 2017: https://krausefx.com/blog/fastlane-is-joining-google I would guess this means they hired the lead developer(s) and funded a team to work on the proje…
Comment linking /blog/fastlane-is-joining-google
on “Google abandoned Fastlane, it has no maintainers currently”Submitted Inappbrowser.com: see what JavaScript commands get injected as a story · 2 points
HN discussion
