Hacker News Reader

Comment by Animats | Hacker News Reader

Mozilla response: ignore problem.[1]

    Component:▸ Security
    Importance: P3 normal
    Status: NEW
    Reported: 6 months ago

This wouldn't be hard to fix. Filter the signal down to about 0.5Hz, which is comparable to how fast most displays auto-adjust for brightness.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1357733

View on HN

So (for Firefox) setting this in about:config should disable usage of the light sensor API (plus other sensors that could be also working against you), right?

> device.sensors.enabled = false

> Filter the signal down to about 0.5Hz, which is comparable to how fast most displays auto-adjust for brightness.

No, that wouldn't help.

From the article: For the light sensor, limiting the frequency will not thwart our attacks; even frequency as low as 1Hz would allow the same type of attack, with only factor-of-two slowdown.

This "vulnerability" is extremely hypothetical and they have not given proof that it can be exploited in the field. Just conjecture and a demo in a totally unrealistic environment.

It's not hypothetical at all. Watch the demos; they clearly demonstrate data being exfiltrated. Additionally, the article mentions several times that yes, the bits/sec is quite low due to several factors. I don't think the author is exaggerating the situation at all.

Would you rather wait for the API to go live and then be abused to steal real data? I would much rather researchers discover and report on possible attack vectors long before they are enabled by default. "Trust by default" long ago proved foolish.

> Although in our proof of concept demonstrations we rely on the assumption that the light conditions do not change during the exfiltration phase, extending the demos to handle these situations shouldn’t be a problem

They say themselves that their demo is not real world and wont work in the real work and then say it "shouldn't be a problem" to make it work.

Not to mention that it takes 20 seconds of flashing the users screen to do the thing (how is that supposed to work without setting off alarm bells).

As I said, they have no proof of a real world vulnerability, only proof it a staged environment, and they readily admit it.

> they have no proof of a real world vulnerability

So what. This "default allow" attitude is easily more damaging than any other source of security problems. You (or anyone else) cannot know all of the ways exposing new data could be exploited, or might already be exploited in ways that we are not lucky enough to know about.

Caring about security - which includes the future unknown unknowns you don't yet know to even look for - means minimizing what is exposed to the public attack surface to what is both needed (which does not include anything merely "wanted") and demonstrated/proven to have trivial risk with known limits.

Reply on news.ycombinator.com