Slashdot Mirror
Your Battery Status Is Being Used To Track You Online (theguardian.com)
A paper published last year revealed that the battery on a laptop or phone can be used to track one's online activities. The vulnerability resided in a built-in HTML 5 specification, which could be tricked into identifying people and tracking their online activities. One year later, we are now learning that the vulnerability is being exploited in the wild. The Guardian reports: [...] Two security researchers from Princeton University have shown that the battery status indicator really is being used in the wild to track users. By running a specially modified browser, Steve Engelhard and Arvind Narayanan found two tracking scripts that used the API to "fingerprint" a specific device, allowing them to continuously identify it across multiple contexts. The research was highlighted by Lukasz Olejnik, one of the four researchers who first called attention to the potential issues with the battery status API in 2015. Although Olejnik achieved some success following his warning, with the body in charge of the web's standards thanking his group for the privacy analysis, the API still has the potential for misuse. And while it is only tracking scripts using it now, Olejnik warns that unscrupulous actors could do more. "Some companies may be analysing the possibility of monetising the access to battery levels," he writes. "When battery is running low, people might be prone to some -- otherwise different -- decisions. In such circumstances, users will agree to pay more for a service."
In Firefox, you should go to about:config and toggle dom.battery.enabled to false. I've read this exact advice on many privacy-related websites for over a year, so this really isn't news.
Why on Earth are browsers revealing my battery status to random websites?
Does Google dictate these changes in exchange for funding?
Edna Krabappel: Now, whose calculator can tell what seven times eight is?
Milhouse Van Houten: Oh! Oh! Low Battery?
Edna Krabappel: [sighs] Whatever.
Actually don't. The previous story has absolutely nothing to do with this story and nothing in the comments relates to it.
The person who posted this is a retard.
Uber is already doing this to gouge customers.
http://www.forbes.com/sites/amitchowdhry/2016/05/25/uber-low-battery/#70628b966f1d
Uber is doing it
But as for tracking, why not just report battery level by 10% increment, or some other increment where you can hide in a gaussian distribution? Really they only need to know Full, low, and not full or low.
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
WHY ON EARTH a browser need to expose the status of my laptop battery!! Why?!?! Can we have a browser that JUST display text, images and basic please! Can we go back to HTML 3.2 and flush everything made after this!
Will $CURRENT_YEAR be the year of the Linux Desktop?
To call profit-maximizing strategies "unscrupulous", we'd have to claim everyone who makes above bare subsistence income is an unscrupulous actor. Women complaining they don't get paid as much as men would be unscrupulous, trying to get more pay without doing more work.
You need a bit more of an ethical quandry than that before you can start claiming bad ethics.
Support my political activism on Patreon.
When a web site can get something as private as a battery status, you know that the web app bubble has gone too far. I hope the web app bubble burst along with millenials having to get off their phones and having to use real computers with CRT monitors and Internet Explorer 6.
this sort of manipulative and underhanded approach is also known as "aggressive marketing." its been essentially the only means advertisers use to sell since the 70s when we stopped marketing products and switched to marketing brands and lifestyles.
im guessing in another 20 years most advertising is just going to be a thin man with a dark cape standing next to me attempting to exploit random fears until i buy some deodorant.
Good people go to bed earlier.
This is exactly why you're losing your most adamant users, if not entirely then at least as peer to peer marketers on your side. There is absolutely no way any sane web developer is going to use that feature in the intended way. That is a feature made to be abused. By adding it, you have leaked credibility like water through a sieve. I can not recommend a browser to people who don't even know that about:config exists, and who will be exposed if they don't change dozens of settings that don't even have a user interface. Without my recommendation, these people all choose Chrome. I am the reason they still know that Firefox exists, because they see me use it, but when they ask my why, I say it's a matter of preference, not that it's the better browser, because I will not lie for you.
Accidentally modded wrong comment.
HTML5 knows too much for web pages. It seems to have a lot of APIs which simply should not exist at all.
I think the problems all came from the idea that programmers want to run full applications in the web browser; that it needs to be an OS in itself. Back in the 1990s the "thin client" sounded like good idea, simply because a majority of the marketplace was saddled with an extremely bad legacy OS (MS Windows) which no one wanted to work with, but everyone had to.
Now Windows is gone (or at least you rarely see it outside of large offices) but to kill it, we had to make the "Javascript OS" full-featured, and the "thin" in "thin client" was totally forgotten. Now your browser is the most complicated thing on your computer, an entire OS within an application on your OS.
So it's true: a web page will never need to know your battery status, so having the API is an obvious bit of fuckwittery. But we aren't talking about web pages; we're talking about applications which just happen to use something called a "web page" as their screen or window.
It wouldn't have necessarily been a stupid idea, except that this OS is made to download and execute applications from whatever network source that it's told to. You say your information is being sent to random web sites, but I say you are downloading and running networked applications from random websites. Why are you doing that?
Sorry, didn't mean to put you on the defensive. You're doing that because your web browser does it. You didn't want to run some random application, but you did, at some point, load a web page which contained a script tag that shouldn't have been there. You say "but it's just a web browser!" and I'm explaining, "No, it's an Operating System." Eww.
Your Battery Status Is Being Used To Track You Online
Oh, do fuck off with the tiresome clickbait headlines. My battery status isn't being used to track me online, but even if it was, you could write the headline without having to personally address it to me.
systemd is Roko's Basilisk.
If it was easy for someone to plant a modified binary on your phone they could also do just about anything they wanted.
"In such circumstances, users will agree to pay more for a service." -- cough *Uber*
I/m always plugged in when I go online
Is there anything that can't be used to suck up your personal information, location, spending habits, etc etc?
"Some companies may be analysing the possibility of monetising the access to battery levels"
Holy shit, kill me now. But first let me throw a few marketers into the wood chipper.
"When battery is running low, people might be prone to some -- otherwise different -- decisions. In such circumstances, users will agree to pay more for a service."
Okay, now I really mean it, just kill me. And make sure to plaster advertisements all over my headstone, okay?
Just cruising through this digital world at 33 1/3 rpm...
Not only is there no reason for the computer to send my battery, but there is NO reason to send ANY information beyond what I expressly tell it to.
Someone wants to know what my browser or what addons I am using, I should have to expressely tell them. Otherwise it should send a default value.
excitingthingstodo.blogspot.com
This exploit requires an attacker place a custom-precracked browser on your PC. Without it, the exploit does not exist.
This is the same kind of hyperbolic bullshit as when they say your car can be hacked remotely, when in reality one must have physical access to your car's ECU to install a wireless serial transceiver on the CANBUS first.
FUD and scare tactics. Laughable, man!
Should be DISABLED by default... who would even want a "low powered" version of a website? This was a bad idea from the beginning
MINUS 1? Moderator bias detected. Must be a Microsoft house here.