Apps and websites

Access to sensor data

Smartphone apps: Native apps can directly use hardware such as GPS, camera, microphone and other sensors. This is done via APIs that require explicit user permission. Once permission is granted, the app can continuously and in detail access data.

Websites: Web applications run in the browser and have much more limited capabilities. They can request access to certain sensor data via modern web APIs (such as the Geolocation API, Camera API, etc.), but this access is usually limited and strictly controlled by the browser, often with repeated user consent. Therefore, a website cannot start the camera or microphone without the user's knowledge.

Access to storage

Smartphone apps: Apps have access to local storage, which means they can store larger amounts of data in the form of files, databases or cache. This storage is often beyond the reach of other apps thanks to sandboxing enforced by the operating system.

Websites: Websites use methods such as cookies, localStorage and IndexedDB. These forms of storage reside within the browser's sandbox, keeping the data separated from the rest of the system and less vulnerable to misuse.

Security guarantees and sandboxing

Sandboxing: Both smartphone apps and web applications run in a sandbox environment. For apps, the sandbox ensures that they only have access to resources for which explicit permission has been granted and limits interaction with other apps or system data. Browsers operate in a similar manner, with each website running in an isolated environment.

App store control: App stores such as those from Apple and Google screen apps for harmful code, unsafe practices, and abuse of permissions. This increases the likelihood that an app is secure, but it does not guarantee that the app is free from vulnerabilities or that the developer always handles data safely.

Conclusion

  • Access and capabilities: Smartphone apps generally have more direct and extensive access to hardware sensors and local storage, while websites have much more limited capabilities.

  • Security mechanisms: Both platforms use sandboxing to protect data, but their implementations differ.

  • No 100% guarantee: Although app store control and sandboxing provide an extra layer of security for apps, there is no 100% guarantee. Users and developers must handle privacy settings and follow security best practices conscientiously.

Next page