Help me clear my questions regarding PWA

djcf

Straight to the point. Are there any security/privacy advantages to use PWA:s instead of native apps in GrapheneOS (with Vanadium browser)? I need access to LinkedIn and Messenger, is it better to use PWA or native apps? Should I put them in a separate user in any case?

Dumdum

djcf is it better to use PWA or native apps?

Depends. You might want features that are only available through native apps (if there are any). You might want notifications or widgets. If not, then a PWA benefits from the security hardening of Vanadium.

djcf

Dumdum Thanks. Notifications are not really necessary, but I really don't want Meta to farm information from my phone just because I don't understand what Vanadium lets the web app do. I've read in other threads that people tend to use PWA's to make profile switching less important for social media etc. But I don't really understand how much information let's say Facebook gets from a PWA in the owner's profile compared to a native app in a separate profile.

[deleted]

djcf I would say PWA gets less user data thanks to Vanadium hardening, lighter (smaller) code and diminished functionality compared to native app. That said, PWA may be more private to use but not necessarily more secure.

djcf

Ok thanks. I guess the safest bet still is using a separate profile to not let the app talk to eachother.

yore

djcf PWAs, from my knowledge, are no different than using the website except that it has the appearance of an app.

For privacy, PWAs are better as apps can get far more information about your device. For some apps that require an app, you can use it as a desktop site and it often works as the site thinks you're on a desktop.

djcf

The problem is that I read different things from different sources. I've also read that PWA can run in the background more like a native app and then the leap to gather telemetry isn't that great in my mind. But as you probably know by now I don't know anything about coding for Android.

But if it is only a html page nd nothibg more I guess Vanadium together with a restrictive DNS service would be far better than a native Meta app.

yore

djcf I've also read that PWA can run in the background more like a native app

I have read similar things too. I presume it has to do with PWAs on desktop, but all I know is that on Android (at least GrapheneOS), PWAs are basically shortcuts to the website.

As for a custom DNS for content filtering, keep in mind that while it may prevent some ads and trackers from loading, the app can know that you are using content filtering, potentially increasing your fingerprint.

djcf

Thanks. I guess I'll use PWAs when I can then.

boards_of_canada33

sorry to re-open this dead thread, but regarding pwa vs app: for apps in the google and meta ecosystem, wouldn't PWA suffer from cookies (and maybe other tracking?) being all added together? I was avoiding logging into a google account on my main profile's vanadium browser because then all the other pages which have google tracking cookies would then connect to my google account. I use k9 for email, but it seemed like even the gmail app would be better (without services) since the apps are all isolated. But maybe I'm misunderstanding something here.

ryrona

boards_of_canada33 regarding pwa vs app: for apps in the google and meta ecosystem, wouldn't PWA suffer from cookies (and maybe other tracking?) being all added together?

Third-party cookies are disabled by default in Vanadium. This means that only cookies for the server shown in the URL bar can be fetched and stored. So if you are visiting website A, neither it nor any third party scripts or resources it loads can access cookies stored for website B. This should prevent most tracking, as Google or Meta scripts embedded on website A cannot fetch or store cookies for Google or Meta domains when visiting website A.

boards_of_canada33 I was avoiding logging into a google account on my main profile's vanadium browser because then all the other pages which have google tracking cookies would then connect to my google account.

No, this should not be possible.

However, websites can implement single sign-on, by redirecting you to Google, so server in URL bar become Google's, but with a unique identifier attached to the URL parameters, and then the website you visit can talk directly to Google too, without going through your device and ask who it was that just visited Google with that unique identifier, and get the Google account name back, with login token and status as needed.

But this single sign-on functionality can be implemented by apps too, as apps can call other apps installed in the same profile, including with a unique token. So it is not a privacy downside with PWAs or Vanadium in relation to regular apps.

boards_of_canada33 since the apps are all isolated.

No they are not. Apps can communicate with other apps in the same profile, and share information about logged in accounts and such. Just like PWAs or websites can inside the browser.

Ideally though, we would have app communication scopes to prevent this for regular app, or a per PWA cookie and cache storage for PWAs. Either of those would prevent such tracking. But today such tracking cannot be prevented, except for having PWAs or visiting websites in different browsers, or installing regular apps in different profiles.