Claims of Sandboxing in Other Apps
A long-time Hermit user recently wrote to us,
I used Toby Kurien’s WebApps SandBox browser in my Android phone before I switched over to Hermit, and it has a sandboxing functionlity like yours.
They went on to describe their experience using two web apps at the same time in that other app.
However, in our testing, we found that the app did not offer the privacy feature they described.
Testing the Sandbox Feature: Focus on Simultaneous Use
To test whether an app correctly isolates your web browsing into multiple independent sandboxes, you must test when they are all open simultaneously.
Two (or more) windows should both active in Split Screen mode or Multi Window mode at the exact same time. Switching from one app to another app is not the same as having both run simultaneously, because Android will put the previous app in a stopped state when switching away from it. In Split Screen mode, they truly run at the same time.
Video of Our Tests: WebApps Sandboxed Browser
We tested “WebApps Sandboxed Browser” v4.3, the latest available version as of Nov 14, 2021. Last update was 9 months ago, on Feb 9, 2021.
- As you can see from this video, we start with a Reddit account
“sandboxtest1”in the top window, and a second account“sandboxtest2”in the bottom window. - When you refresh either one of the two web apps, then both of them switch to one or the other account.
- They do not retain their sandboxed status.
- Any private activity (e.g. search queries or browsing history) will be commingled between the two supposedly-sandboxed web apps.
Privacy Policy?
This is a security vulnerability, and potentially false advertising.
This likely also violates any reasonable privacy policy, but we can’t seem to find their privacy policy.
- In the app itself.
- Play Store listing: https://play.google.com/store/apps/details?id=com.tobykurien.webapps
- Their GitHub repo: https://github.com/tobykurien/webapps
- Their FDroid page: https://f-droid.org/en/packages/com.tobykurien.webapps/
Compare with Hermit
To see how Hermit compares, here’s a similar video.
Rest assured: Hermit will never mix your sandboxed content with each other!