Stealing sensitive browser data with the W3C Ambient Light Sensor API (2017)
blog.lukaszolejnik.com
blog.lukaszolejnik.com
Why is this even a thing?
Just make this the same as location or microphone prompts? I never understood the fear of being transparent or give choice to users.
I hope at least firefox has a setting to permanently disable this feature.
You just know the argument being made is "Light sensor input changes frequently enough that it isn't useful for fingerprinting." But history tells us that literally everything will be used for fingerprinting.
Provides a tiny amount of differentiation to maybe identify particular devices? Scoop it up!
Or if you're already able to identify a particular person, how about keeping a persistent log of whether they're indoors or outdoors and aggregating that from as many different sites as possible? Collect all the data and store it forever! Maybe it will help sell ads 0.004% more effectively, and there's no downside!
IMO, whatever amount of risk this carries clearly outweighs the benefit of websites being able to access my light sensor without asking for permission, because the value of that is 0.
I doubt it's even this particular feature, just an ethos of: let's add as much as possible because it'll increase our relevance.
But here's a crazy idea for them:
@media (prefers-color-scheme: dark) {
color: white;
background-color: black;
}
If they really think they need to access my light sensor, they can ask. Maybe someone wants to make a light meter web app, I don't know. But I do know they have no business accessing sensor hardware without permission.
It's like with the battery API, people had this idea that web developers could say "Oh your battery is low, we'll throttle back into low power mode to respect that."
But instead, websites are happy to continue burning all the CPU, data, and battery life in the world, because by and large developers aren't paid to give a shit about your battery. They're paid to ship features and make whatever metrics go up. So the only thing it gets used for is identifying phones for advertiser targeting.
I don't think you realize how right you are. Fingerprinting is eventually going to be a lost cause. In 10 years or so, we will have the tech to fingerprint anyone just by their writing style (some companies even claim to be able to do this already today). What do you do then? Ban posting stuff online?
...given a large enough corpus of text. I doubt that you're able to pick up much from a dozen 1 sentence replies on reddit, for instance. You could even use some sort of neural network based sentence transformer to scramble the structure without significantly altering the meaning.
It only takes 33 bits of information to identify 1 person out of 7 billion. How many bits did you lose just by talking about neural networks in that one sentence? How many bits did you lose from the timing/time zone of your comment? By the language of your comment?
Which means anyone who does this will probably have made themselves unique, or - I guess- at least narrow down the scope of possible users more than the typing speed would do.
There are hardened browsers that will make the script wait for a while to get the key events. That seems like the right solution; most people using controlled enterprise apps don't have to deal with huge amounts of input lag, while people that are paranoid won't be profiled by their typing cadence.
uhh, probably 2 or 3 at most? Given the demographics of Hacker News (technical background, mostly American), probably half the site have the attributes you have listed.
we're far beyond that; I have successfully fingerprinted users by buttons they press in Office 365
In fact it's better if there's a profit incentive. Alignment of interests is what's been Apple's superpower for a long time now.
There are more levels than just their own direct position though right? Apple's more data/ad-driven competitors directly gain revenue from having more information. In some cases if Apple is able to shape standards themselves in favor of more privacy, their business model enables them to profit in that environment while it starves others of oxygen. Competitors can't just necessarily take the same privacy stance without suffering harm (and conversely, Apple can't fight battles on pricing or data-driven features like AI as effectively). Businesses seeking to alter the environment itself to match their strengths isn't unheard of and can make a lot of sense.
I'd like to see all the sensors permissions lumped together behind a sufficiently scary name ("Permission to spy on you"?), off by default, and for the browser to enforce strict security requirements before it's even willing to prompt the user for the permissions the site's requested.
Web apps aren't going away, but we could have a better UI to enforce a separation between full-fat web apps with similar capabilities to native apps, and the rest of the web that's just trying to abuse those features for spying.
That might be a renamed JavaScript toggle.
But regardless of whether this can be useful or not, why not just let the OS/browser on behalf of the user enable or disable dark mode, by choosing the appropriate CSS? Because as someone else has already pointed out, having the app "guess" whether I want to enable automatic dark mode or not, rather than just obeying my settings (perhaps I always want it on, regardless of ambient light?) is just stupid.
Do you think that this point was never raised with them? It was, look at w3c lists, look at mozilla bugzilla, look at chrome bug tracker and long lists of WONTFIX bugs asking to let user disable those sensors. It goes almost like this "I do not need the website know how I hold the phone, — No, you really have no reason to disable sensors," after them being asked for the tenth time. HOW DO YOU REASON WITH SUCH PEOPLE?
Whomever ever came first with this idea must be found and fired, and people should make sure that no contributions to web standards to be accepted from that person. Whomever followed, allowed, and collaborated on that process should also be fired along.
People who got to write web standards today are unqualified for this role in their prime majority. Some of those "software engineers" speak in more lawyery, MBA-like manner than real lawyers do. They are really hired as lobbyist, to push, push, push their client's proposals to approval in any way possible, no matter how much they have to break the browser to do that. People can't work with them. They are toxic.
It should be a default presumption that people hired to write standards should be highly professional in their demeanour, experienced, trusted, and give no favours to one vendor or another, be direct, and above all be helpful. There should be no second thought about that.
Now, how many of people involved with WhatWG will meet these criteria?
I fight for the user.
Not all apps need it, and the ones who do, should be able to explain why.
The Battery API was removed due to fingerprinting concerns, but a permission-asking battery API would still be helpful to bring web apps closer to native apps.
https://news.ycombinator.com/item?id=7863418
Though this one is much cooler :)
> Perhaps the most obvious solution is to require the user to grant permission to the website requesting access to the sensor
Which makes sense... a light sensor is really a 1 pixel camera.
I don't have any statistics to back it up, but most everyone I know just leaves dark theme on all the time (or in the case of one light theme on all the time).
Totally impractical but a neat idea anyway!