Privacy: Apps are more private than web applications

DeletedUser74

Hello everyone!
I've been thinking about the ways we are tracked online when I came to the conclusion stated in the subject.

Since GrapheneOS blocks many possible identifiers that usually would be used by apps, it is more private to use apps than to be subjected to browser/device finger printing when using the alternative web applications, especially when NOT running Google Play services.

In my opinion, this is a valuable turnaround compared to using IOS or Android, where it would be better to go for the web applications.

What do you think, would you agree?

trashaccount

DeletedUser74 No, its still better to use web-apps when possible. Browser sandbox has an extra layer of security and its actually harder to fingerprint than having the app installed.

GrapheneOS

DeletedUser74 There's far more available to a native app than a web site. Native apps are better in the sense that they're signed packages which are ideally signed offline by the developers and can provide proper end-to-end encryption without trusting a service. An end-to-end encrypted app in a browser only works if the adversary doesn't control the server or a way to do a man-in-the-middle attack and bypass transport security (HTTPS) via either control over a certificate authority or a way to trick them such as a man-in-the-middle attack between the site and the CA.

naibed

Hmmm. In my (limited) experience, I haven't reached the same takeaway.

I would encourage you to try something like trackercontrol/AdGuard Home/pihole in an app vs a browser to see how much app-related tracking is actually taking place.

DeletedUser74

naibed
Very interesting. Are there tools, that monitor what data is collected without blocking trackers etc. ?

DeletedUser74

trashaccount

So the argument is that since the browsers are sandboxed too, fingerprinting is more difficult then without GrapheneOS?

DeletedUser74

GrapheneOS

Thank you for your answer.
If i understood correctly its better to use native apps if they provide end-to-end encryption. Otherwise it is still more private to use web sites. Is that correct?

naibed

DeletedUser74 TrackerControl has one version that passively watches trackers (Google Play) while the other version block trackers (F-Droid/GitHub).

DeletedUser69

DeletedUser74 app sandboxing in this respect works in stock environment also, it just doesn't include system resources with elevated privileges. When it comes to browser tracking you can review your cookie acceptance policy, in any web utilizing native app (many) you agree to those often automatically unless you are presented with options. I do half my browsing with Javascript completely turned off whenever it doesn't break sites. Webapps are more private in nature as previously mentioned and collect way less usable data but can have security flaws.

DeletedUser74

DeletedUser69

Thanks for your input. Blocking javascript hampers fingerprinting, doesn't it? I noticed that many sites dont work without javascript. how do you approach those websites? Do you turn javascript on? Do you simply not use those?

DeletedUser69

DeletedUser74 yes, some I don't use, some if I can't avoid it agree to as little as possible, i.e. banking, email, certain peer review sites etc.

DirtyDan

DeletedUser69 which websites do you visit that don't require JavaScript? I always hear people saying they disable javascript, but what does that even look like in practice? I just visited all of the websites I regularly use and they all require it. Even this forum required it in order to properly navigate it lol