Why are websites requesting access to motion sensors on my desktop? (2019)
grantwinney.com
grantwinney.com
My current job uses USB security keys and I assumed I'd have to configure them in the OS before the browser was aware of them -nope! Chrome knows if the key is in the USB port and can interact with it with my approval, which is exactly right.
The leap from access to USB to access to serial is minimal. As long as the right permission checks are in place.
You're right, and it's such a bummer. I often think about how interesting it would be if we didn't end up with the Chrome/Safari browser duopoly and Windows/macOS duopoly on the desktop and Android/iOS duopoly for mobile. How cool would it be to see what the Amiga, Atari ST, Spectrum, OS/2, BeOS, etc... could have become with another couple of decades development. Even Windows and macOS would probably be different if they had to compete in a healthy, diverse ecosystem.
Instead, further concentration is probably going to happen once Apple allows alternate browsers. At that point, there isn't much to stop Google's Chrome from becoming the only application platform that really matters.
It's just not reasonable to expect every company to maintain more than two or three completely different versions of their apps, and most would vastly prefer to maintain just one, hence Electron and React Native.
It would be a constant incompatibility hell, and most code would be littered with #ifdefs and polyfills.
You can argue that companies producing software tools would specialize, so you would use Microsoft image editing tools on Windows, Foo's image editing tools on Amiga, Adobe's image editing tools on Mac etc, but that argument breaks down when it comes to banks, movie and music streaming companies, games etc.
Then it will be up to the OS maintainers to make sure the software is compatible with their operating system, like how it works with FOSS systems already.
A man can dream anyway...
Making an app means:
Android (and Android TV being more work), iOS, web, Roku, Fire TV, Tizen, Vizio, WebOS (LG), and multiple set top box vendors who all have horrible underpowered CPUs.
Some companies try do to cross platform, and that sort of works, but it is janky and customer complain of the sorts of UX issues that always pop up with cross platform apps, and for any decent functionality you end up writing per-platform shims. Also some platforms (Roku) you have to write an app for anyway because the platform requires using a custom language. Other platforms (Set top boxes) are so underpowered that you can't really run anything resembling modern code on them.
It sucks. It is a huge waste of engineering effort for no real gain. Most customers don't choose a smart TV based on its OS, a large % of people choose based on what is on sale at Costco, and another demographic chooses whatever they are told is "the best" by reviewers.
Mobile app developers dealing with a duopoly have it easy, but even that dramatically increases barrier to entry compared to the 90s where you just had to write one app for Windows and so long as you only used documented APIs, Microsoft would move heaven and earth to make sure your app kept working between major OS updates.
Not if the DoJ forces Google to abandon Chrome. Which they should.
Apple and Google should lose their app store monopolies (including first party default preference), Google should lose the Chrome monopoly. These are incredibly harmful to technology and competition.
Each company has plenty of money, attached user base, and engineering headcount to continue to be wildly successful and profitable without operating in a way that damages the rest of the tech sector.
The idea of WebOS is strong enough it seems to have lived on through Palm, HP, LG and now also a forked version.
It really was late to the mobile os race, but ahead of its time.
https://www.webosose.org/docs/tutorials/web-apps/developing-...
And more generally:
The designer of WebOS now works on asteroid too, though.
But all of these systems did exist. And for whatever reasons, they did not survive in the market. So the market decided they were not what was wanted.
No, the competition decided what they wanted, by using shady-as-shit (as well as out right illegal) tactics to squash everyone else.
People _loved_ their Amigas, STs, Be boxes, etc. They loved them so much that there are still some nutjobs out there trying to keep Amiga alive! Do you think there'd be that kind of devotion for Windows 40 years later, if it died around 3.1?
No, the users didn't choose. A loose hand on monopoly law did.
If only it was as simple as letting buying power decide.
The current amount of hacks needed to make the native desktop apps compatible across even the same operation system, but different versions, is kinda scary. Pretty sure the similar situation for mobile apps too.
The browser space has never been more diverse as well, most of them use Chromium under the hood but who cares, Chrome was Webkit was KHTML when it started too. A browser's success is only somewhat related to its engine. Having a base you can build on that guarantees all current and future website will work and be performant on has allowed for crazy levels of experimentation.
We should all care, because people start writing apps that work on Safari and Chrome only rather than to a standard. The web wasn't meant to be controlled by two companies, the idea was using standards anybody can implement.
Use Firefox and see what sites you are using regularly that doen't work because they are chrome sepcific.
I don't know the reason for the Firefox failure.
The Adobe site https://new.express.adobe.com/tools/generate-qr-code# says it does not work with Firefox, but if I change the User-Agent it does work.
I ran into both in the last month.
Your experience for most of that decade was when Firefox was much more widely used than it is now, so had a higher support priority.
I've long been confused when reading how Firefox doesn't work everywhere. Now I'm even more confused, because you posted an example that doesn't work on your computer, but does on mine. Do I have some kind of Ultra Firefox or something?
On Firefox (I am using the most recent version for macOS) I see only only about a paragraph of text, plus header and sidebar.
In Safari I also see pull-down menus for "Kommun" and "Tidsperiod för bokningsbara tider", plus other input items, and a description like "Antal mottagningar: 23" plus a list of locations.
Are you missing any of that?
It's just a shitty as website by a shitty corporation for shitty ends I guess... I never have such issues with sites that benefit me when I visit them :P
I don't have uMatrix or other ad blocker installed.
I turned off all "Enhanced Tracking Protection" and still see nothing in Firefox.
I don't know what you mean by "by a shitty corporation for shitty ends ... sites that benefit me". It's run by the regional council (https://en.wikipedia.org/wiki/V%C3%A4stra_G%C3%B6taland_Regi...), which is the political organization responsible for the area's public healthcare system. The page lists available COVID vaccination appointments, which benefits me as I was looking to get a booster shot and wanted to know where to go.
While they have shared origins, Chrome (Blink) and Safari (WebKit) have been going separate ways for quite a few years now.
https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API
Isn't that neat?! Well, it could be, as long as you browser didn't allow this to be used, probed or even enumerated without explicit consent.
This is misleading at best. Here’s what the actual spec says <https://wicg.github.io/webusb/>:
> This specification was published by the Web Platform Incubator Community Group. It is not a W3C Standard nor is it on the W3C Standards Track.
It’s an experimental spec by Google (observe the affiliation of the three editors: all Google); Mozilla has adopted a negative position on it <https://mozilla.github.io/standards-positions/#webusb>; WebKit has not remarked upon it.
WebAuthN is different, since it does not provide sites low-level peripheral access – WebAuthN and CTAP have been designed for specifically this environment and go to great lengths to make fingerprinting hard.
As long as you don’t actually use an authenticator on a site to store a credential, it won’t be able learn anything about it.
if(!navigator.usb) {
console.log("learned that browser does not have USB capability");
} else {
console.log("learned that browser has USB capability");
navigator.usb.getDevices().then((devices) => {
devices.forEach((device) => {
console.log(device.productName);
console.log(device.manufacturerName);
});
});
}
Finger printing sounds sophisticated, but it's just collecting the bits and pieces into something that (mostly, probabilistically) identifies you. And then tracking you, surveilling you till you're somewhere where they can identify you.
From there: profit!
There must be a million different ways to establish that, though.
I get the general idea, but this particular data point seems highly correlated with just the family of browser, as GP suggests.
It's also very easy to fix – just make your non-WebUSB-supporting browser expose that object, but always behave as if the user had declined that particular prompt.
Unfortunately, instead, new capabilities are added to browsers constantly and the interfaces commonly are silently made available as part of a regular software upgrade. Sure, thought is given to security and the user is prompted just before something horrible is about to happen (access camera, mic).
But don't underestimate the shitload of "niceties" in the grabbag of APIs that in aggregate reveal more or less a supercookie of your browser instance.
But there are easier avenues that are harder to mitigate. Hashing an image that relies on the browsers rendering of (default) fonts. Highly instance specific, lots of entropy.
That's really not what it is though, is it?
These capabilities will be rolled out for all users of a given browser, or even for a given rendering engine, and I'd assume that your browser family is already easily fingerprintable. In other words, they are all highly correlated.
Things like installed fonts, window sizes, your clock drift etc. are a different story. These lower-correlation measurable properties are the real supercookie problem.
My desktop has 12 things on the bus. 8 are soldered on to the motherboard, and 4 are plugged in. There are at least 32 choices for each of the things, so that’s 5 bits of entropy per device — 7 bits, ignoring the motherboard.
If you allow Camera access you get a metric ton of bits.
Sure, but the fact that browsers became operating systems is unreasonable in the first place.
I don't think so at all. Web-based applications tend to suck, and it seems to me that much of the reason is because the browser is very imperfect as an OS.
And don't forget shopping online, there are a few small web shops out there with great UX.
And you can use 20 year old websites just fine, the web has great backwards compatibility too.
Web apps don't have to suck.
I think if HN counts as a web app, then "web app" has no meaningful definition.
> Web apps don't have to suck.
Maybe, maybe not. All I know is that the ones I've used (and have to use at work) do suck.
I never considered them as such, no. Those (including HN) are just ordinary websites with some amount of interactivity.
To me, a "web app" is a thing that replicates a normal application in web form. Things like GMail, Office, etc. In other words, they aren't things that uniquely leverage the web, they're things that are using the web as a shortcut to platform independence.
But perhaps the definition has changed, and I need to be much more explicit and specific instead of using the term "web app". I could buy that, but it also means that I don't actually know what a "web app" is anymore.
I don't think it makes a functional difference, except for "more" links instead of universal scrolling. Just like can't tell between static blog and dynamic blog, can't tell between static HTML and dynamic JavaScript. I would say "web app" is where download JavaScript, and the JavaScript builds the page.
Which has 0 to do with the virtues of the Web as OS and much more to do with catharting the pain and frustration induced by sharing the digital world with people with shockingly bad points of view through acting in kind. A game nobody wins; alas...
Sure, we all complain about Chrome and its outsized influence, but at the end of the day the standards are more open than not and Safari and Firefox mostly work most of the time on most of the pages. That's a stark contrast to, say, .NET vs Cocoa or Android vs Apple app stores.
well, that sounds perfectly reasonable that only some pages are not standards compliant. :facepalm:
Sure it's not great, but the alternatives are worse.
That's a fashionable observation; I think it's a kind of illness. The idea that you can take over anyone's computer, and make it do things the user doesn't want done, and doesn't know are being done, makes some web-developer's heads swim; they can turn the whole internet into a sort of distributed supercomputer for their own private use. WHATWG bears a lot of responsibility for this.
A real operating system doesn't download and execute code from unverified remote locations. Nearly every website nowadays tries to load and execute in the browser code from any number of remote locations, without the user's approval or even knowledge. By default, I only allow 1st-party JS, which I consider to be an extremely liberal policy.
Sorry, but that is pretty much the standard way to install apps on windows.
That the browsers execute untrusted code all the time and still are secure is an advantage of web technology.
Maybe now, but when I was on XP and, later, Windows 7, you only had a handful of software you would use (I have all of them on a CD, and later on an HDD). Things like VLC, Notepad++, Codeblocks, Office, and others. It requires trust, but these programs did not phone home, AFAIK, every second. That's what we lost, trust in our computer and the software programs running on it. And now, it is a hostile relation between customers and software developers. I wasn't concerned about VLC tracking the file I opened with it, or Office scanning my documents.
But they aren't secure. Most of that untrusted code is doing stuff that's of no value to the user, and is positively against the express interests of many users.
The browser is more of a universal user interface than a universal OS.
Of course something like chromeOS/ChromiumOS is an OS what boots directly into a browser, but it’s not a universal interface.
Maybe WebOS was a step in that direction being a mobileOS that was all html and JavaScript.
Screenshots: https://www.webosose.org/docs/guides/getting-started/webos-o...
https://www.webosose.org/docs/tutorials/web-apps/developing-...
I suppose. Not for me, though, as I don't (and won't) use web apps or complex websites. I sorely wish there was a browser that simply didn't have that capability.
Ideally it wouldn’t mean random web sites request motion data from you but I really don’t see this as ruining the internet.
These are all quite useful tools. I've never used WebMIDI but it's older than the other Web* APIs. When you have a use case for them, the APIs are a lot better than figuring out a cross platform serial port protocol (or, more realistically, writing a Windows application and letting the Linux/macOS/Android users figure it out themselves).
WebSerial/USB/Bluetooth doesn't do anything unless you permit it to. If websites used this feature, you've clicked "okay" when mapquest.com asked to use your serial port.
Unfortunately, Mozilla decided that this (and other related functionality) is "harmful". https://mozilla.github.io/standards-positions/#webserial
It is a shame, because the overlap between people who use Firefox as their main browser, and people who tinker with microcontrollers is likely pretty large.
I understand why Mozilla is hesitant. "Why does a browser need to give access to a serial port" is a good question. Certain web tools have definitely proven useful (especially when using an Android device to flash microcontrollers!) but if you asked the average internet user 20 years ago if their browser should provide websites with access to their serial ports, you'd get laughed at.
I hope Mozilla reconsiders their positions on this, because this is just one of those reasons I keep Chrome installed. I need it very rarely, but when I do, it's often because Mozilla made a choice I disagreed with (like their decision to remove anything resembling PWAs on desktop Firefox, which is why I have a bunch of Chrome shortcuts in my application launcher now).
Why does a program need to give access to a serial port?
> if you asked the average internet user 20 years ago if their browser should provide websites with access to their serial ports, you'd get laughed at
What if you included "Only if you allow it"?
> What if you included "Only if you allow it"?
You'd probably hear something like "IE/Opera is bloated enough already", I just want my downloads to finish faster.
Could also help detect agent string falsification: why would a device claiming it's UA is legacy IE have motion sensors?
Web server to web client: I'm not sure your so-called "user" represents a real-life human user. Can you at least prove that you're a real-life web browser?
Web client to web server: hmm, well okay, here's my User-Agent header. Just curious why you care about who's sending the request?
Web server to web client: Still not convinced, can you give this CAPTCHA to your so-called "user"? As to you second question: bots, spam. And the ad network sponsoring me doesn't trust my tally.
Web client to web server: My human hates CAPTCHAs, and AIs are better at it anyway.
Web server to web client: Ghrmbl. Okay let me talk to Widevine/FairPlay/PlayReady DRM or your microphone/gyroscope/battery level/uptime/...
...
The arms race of surveillance enshittification.
Bots will either all have the same (or a low diversity of) fingerprint, or if not then they will have the same randomisation techniques to mask the fingerprint.
Some of the additional browser features that access devices do reveal the most trivial way to determine "this is not a bot as bots don't have this fingerprint".
Of course that has implications, if privacy makes you look like a bot (it does), then the web has more friction the more private one is.
Now you’re playing botsimulater 2023.
The application developers one day notice that we have no less than 10 different tracking pixels blocking page loads and eating page performance to death (not to mention sending tons of tracking data out to god knows where). They do a git blame, call the marketing manager into a meeting, who doesn’t know what anyone’s talking about because that was “years ago” and just gives permission to delete all of them.
Then she comes back a couple days later upset because heap stopped reporting.
It’s fun to imagine a “1984” prequel that would take place in an era when the Party is not full-blown totalitarian, and the telescreen pretends to be a useful information source that asks for permissions so it can better serve you. “1969”?
...And a law, that holds browser vendors accountable when neglecting this.
And abuse in this space is rampant.
A red herring is often used to mean an idea that leads one astray.
A red sparrow (or whatever animal) should often be used to mean a response that anulls one's idea.
The kind of whatabout-ism and but-it-already-is-everywhere responses are the old slippery slope concept, practiced in real time. They do nothing to discuss the facts at hand and are a void of useful conversation.
note: maybe an aussie bird, cause culturally aussies love peace, and will trick people to get it.. like Barbossa in pirates of the carribean..
the Crimson Rosella has a 'cussik-cussik' sound and a series of harsh metallic screeches. like a robot bird...
https://australian.museum/learn/animals/birds/crimson-rosell...
Red rosella - to make robotic screeches in an attempt to anull disliked ideas...
(or something)
HN really loves to hate those regulations and laws.
I accept there may be more teeth in the background, but nobody sees that. That's all entwined with legal maneuverings in courtrooms. What we actually see on the Internet is "everything is exactly the same, but with a new pop-up".
I don't really have an answer, so it's not like I'm much help. I'm all for laws that protect, but if they don't do anything other than make things way more complicated, that's really just a boon to big tech, who can absorb the costs.
DMA should reinforce this: https://ia.net/topics/unraveling-the-digital-markets-act (see "Law: Not giving consent")
If the actual enforcement wakes up.
It's illegal to record people without their permission, in certain jurisdictions. We're already stifling innovation!
It's illegal pay money for certain services. We're already stifling innovation!
You're arguing against something negative that hasn't yet happened at the cost not doing anything to prevent something negative already happening right now.
So they’ll be triply unarsed to care enough to politically activate laws about it.
The best hope is Apple kicking Google in the nuts because they want the ad revenue instead.
God help us.
The people beating the drum of user privacy might really just be doing it as a way to block competitors from getting an advantage. Weaponized Privacy.
Or perhaps... users don't have the technical literacy necessary to understand what expectations of privacy aren't being met.
If someone could take a penny from everyone in the world? Now they have 80 million dollars ...
I, for one, would be perfectly happy with the law that on the required actual informed consent. Of course, it would also have to outlaw coercing consent, because companies will immediately go for loopholes.
youll also see "enable DRM playback" on many news sites or aggregators. both of these actions are user-hostile attempts from not-google to target ads to you.
It sounds like you have developed a full-on mobile application at that point.
And I'm fairly sure it's easier to write an HTML page with a couple of lines of JS using webUSB than it is to develop a mobile all with all the boilerplate.
What are "those lightsaber games that were super popular early in the app store's life"?
(Bonus: when you accidentally drop it while swinging, you get to buy a new iPhone!)
Websites are getting obnoxious these days. Most tracking software on them will trigger all kinds of authorization modals for various APIs. And you can bet there will be a bunch it will try to use without authorization if there's a work-around.
It's all fingerprinting to sell data.
If you consider the stuff Google, microsoft or apple, etc do, claimed to be doing, being suspected of doing. I don't consider this to be a very positive development.
It’s more like a captcha for browsers, i.e. if the user is using a real browser it should behave in a way that pre-scripted bots can’t easy replicate. The payload is auto-injected by Akamai so the expected behaviour can be altered in a non-deterministic way.
Oh, and please add [2019] for clarity, thanks.