TL;DR: ProtonMail might want to delete this before they get sued by Meta for defamation, because the original research does not say that about Meta, it says it about TikTok.

--

I found the same sources, but if you'll notice, the article that ProtonMail linked to actually isn't about that. It's about a different and new Facebook thing that has iffy privacy settings as well.

It links to another Gizmodo article about it, buried deep in ONE paragraph.

The problem? That article is about TikTok and the things detailed about the javascript injected that's keylogging is all related to TikTok.

When you click on a link in the Facebook or Instagram apps, the website loads in a special browser built into the app, rather than your phone’s default browser. In 2022, privacy researcher Felix Krause found that Meta injects special “keylogging” JavaScript onto the website you’re visiting that allows the company to monitor everything you type and tap on, including passwords. Other apps including TikTok do the same thing.

This paragraph from the article links to this article in question:

https://gizmodo.com/tiktok-keylogging-privacy-meta-1849433690

This article references Meta a few times but is mostly about TikTok. Then THAT article links to the original blog post:

https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser

He has info on TikTok and Instagram, and while Instagram is injecting javascript into an internal browser instead of the default system browser, it is not noted as capturing text including passwords.

Capturing text and passwords is only ascribed by the security research to TikTok and TikTok alone. Meta companies are using similar Js injection tactics, but they, according to the original research, do not include keylogging.

I dug up this mastodon post and they cited this:

https://gizmodo.com/meet-link-history-facebook-s-new-way-to-track-the-we-1851134018

I agree. Multiple apps bind to the keypress event to inject functionality. Binding to such event does not automatically imply nefarious intent.

https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser

Kraus makes very clear that while Meta apps are also injecting javascript, that he only has evidence of TikTok doing "keylogging" type activities. Both Gizmodo and ProtonMail are wrong in that regard.

It's like nobody has real media literacy anymore, even media organizations.

Given this is the top comment it should be pointed out that while Proton was incorrect about this being Meta there is research out about TikTok doing this very thing.

The way you've worded your comment makes it seem like this either can't happen or isn't happening and that simply isn't the case.

Maybe not keylogging but it's pretty fucking bad still, it tracks basically everything else about how you navigate when using the integrated browser.

Signal, bro.

Not so simple solution, because other people are using meta products and using them on you without telling you about it.

Use firefox, and install the Facebook container extension so that meta cannot read your data on the internet.

dont blame the victim.

Always has been.