Slashdot Mirror
Chrome 56 Quietly Added Bluetooth Snitch API (theregister.co.uk)
Richard Chirgwin, writing for The Register: When Google popped out Chrome 56 at the end of January it was keen to remind us it's making the web safer by flagging non-HTTPS sites. But Google made little effort to publicise another feature that's decidedly less friendly to privacy, because it lets websites ask about users' Bluetooth devices and harvest information from them through the browser. That's more a pitch to developers, as is clear in this YouTube video from Pete LePage of the Chrome Developers team. "Until now, the ability to communicate with Bluetooth devices has been possible only for native apps. With Chrome 56, your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API," Google shares in the video. "The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript." In other words, the API lets websites ask your browser "what Bluetooth devices can you see," find out what your fridge, and so on, is capable of, and interact with it.
Will this affect Chromium as well?
Prepare for the era of Bluetooth spam 2.0. Now, you don't even need to buy spammer hardware from Chinese, just write a website with bt spam script.
Now that pop-up blockers are really good (well, they don't fully block javascript screen blocks yet), we'll have to deal with ads flashing your room lights to match whatever auto-play video they've forced in your face. Can't wait for the first lawsuit when someone has a seizure or when a site dim the lights and someone stubs their toe.
You have no _idea_ what my fridge is capable of.
So despite all ad blocking efforts from the user, this API provides a great pathway to do some digital fingerprinting and establish a cross-site identity. And if you happen to log in on certain sites that use this, they will be able to establish your real identity on any other site from there on in as well.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
Laugh all you want, but I'll be using Firefox Aurora on my phone. Chrome isn't even installed.
Any suggestions for other good mobile browsers?
Google has gone completely bat-shit insane. How on earth did they think this was a good idea, let alone actually go forward and implement such a thing in the release product?
Just mind-boggling.
"Excuse me, I'm from the computer services group, and your A/C appears to be acting up... It's reporting . Please go to this website and click 'Accept' to all the prompts and we can diagnose it remotely".
Yea, no problem catching idiots with that...
This will be the first thing I block.
I just got done setting up a heart rate monitor on a machine at a clinic where we use a web based software package on firefox. The bluetooth stuff is one of the last things requiring a native application. I wonder how much longer we'll need any native software at all with stuff like this coming out.
I'll be honest, I just don't get the appeal. What the fuck do my appliances need connectivity for?
Mod me down with all of your hatred and your journey towards the dark side will be complete!
It's been awhile since we've had jesus freaks spamming shit here. It's nostalgic of the time when we actually fought against ignorance. Today we're only 'allowed' to fight ignorance when it isn't islam.
And of course this won't be used to better refine browser fingerprinting techniques. At all.
your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API
Given the fact that even the battery API was abandoned for privacy reasons, I just don't believe it is ever possible to do this securely and privately. This is just an attack vector begging to be exploited.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
I was just about to upmod it - I thought this guy was going for a "+5, Funny".
This is complete opposite from "Don't be evil". This is outright intrusive and evil.
Given the fact that even the battery API was abandoned for privacy reasons, I just don't believe it is ever possible to do this securely and privately.
Chrome allows filesystem access. You give permission for an app to access a specific location in your filesystem. I don't see why you can't just be asked whether you want to give permission to do Bluetooth things, through the same mechanism.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Google has gone completely bat-shit insane.
Insane like a fox.
You must think that you are their target customer.
Silly. Using a computer is an attack vector. Go live in the mountains tinhatfoilboiiiiii.
So despite all ad blocking efforts from the user, this API provides a great pathway to do some digital fingerprinting and establish a cross-site identity.
You are aware that Google is an advertising company right? People tend to forget this fact and how it will tend to incentivize them as an organization. Your privacy is really of no concern to them unless it creates a PR problem.
ActiveX.
Good luck with that. We will need it.
Lisias@Earth.SolarSystem.OrionArm.MilkyWay.Local.Virgo.Universe.org
How long before the criminals use the Bluetooth connection to turn off various important household systems? When it's -10 degrees F/ -23 C in the upper Midwest of the US and in Canada it is highly inconvenient to get a message to the effect that "Your Carrier Xfinity Furnace has been turned off and locked by us by remotely disabling the furnace control board firmware. To receive the code to unlock it and restore heat in your house, please submit 2 Bitcoin (about US$ 2000) to the following account before your pipes and your family freeze. And by the way, we also opened your garage door for your convenience and more rapid cooling." I would be very interested to know how to disable the Bluetooth API in the new versions of Chrome/Chromium. (I run both).
Would you prefer that only native apps be able to access Bluetooth devices? Then companies will just make the required native app exclusive to the operating system other than the one that your PC runs. For example, one company might be tempted to make a device's corresponding native app exclusive to macOS. Another might be tempted to make its own exclusive to Windows.
The real question is, why is such a wall of text, posted by an AC and with a score of -1, auto-expanded to full view while some real comments are not?
#DeleteFacebook
This reminds of the good old days when you could run code in documents and infect people with them. The only difference is that at least in that case, this was limited only to documents and only from microsoft. Nowadays, since everything is being to pushed to the web, this is much worse.
Avantgarde Hebrew science fiction
...provided that the user is informed when a website wants to use it and it's strictly opt in. Firefox works this way regarding sharing of location information.
My point is that everything that lessens the dependence on native apps is good because then it's less difficult to change platforms.
Google is the new Microsoft which was the computer equivalent of the Fuller Brush salesman shoving his foot in your door. I hope this is OFF by default.
Some drink at the fountain of knowledge. Others just gargle.
The difference being that filesystem access is still gated by the OS.
-- Sometimes you have to turn the lights off in order to see.
But you can't even trust the tin foil since it's been made with computer-controlled machines.
#DeleteFacebook
bluetooths range kinda sucks and even more so with walls though. :/
Sigh. Go ahead and fight Islam all you want. Fight Christianity and Judaism too while you're at it. Meanwhile, the rest of us only want tech news without the alt-right choir section in the comments of every story.
It's been awhile since we've had jesus freaks spamming shit here. It's nostalgic of the time when we actually fought against ignorance. Today we're only 'allowed' to fight ignorance when it isn't islam.
The funny thing is that this nutter is almost certainly turning people off to his kooky fairy tale rather than making them interested in it.
Just cruising through this digital world at 33 1/3 rpm...
when no man has ever traveled through all time and space.
But I've done both, as has everyone here.
Show me someone who hasn't traveled through time and space and then maybe I'll pay attention.
Just cruising through this digital world at 33 1/3 rpm...
Did you register that fancy new Bluetooth appliance for the manufacturer's warranty? Because if you did, now Google can obtain your exact physical location any time it wants.
No, I prefer that no software except the Bluetooth driver recognize a device as being Bluetooth. As far as any application can tell, a Bluetooth headset with microphone should be indistinguishable from any other stereo audio output and mono audio input.
That works because your PC's operating system is aware of "stereo audio output" and "mono audio input" as a device class. Are the major PC operating systems aware of, say, "CNC mill" or "3D printer" as a device class yet?
Good luck compiling "auditable source code" that depends on Cocoa for anything other than macOS, particularly if it depends on the parts of Cocoa that GNUstep doesn't replicate. Or vice versa: Good luck compiling a Win32 application and device driver on macOS or Linux. (Wine doesn't run drivers.)
or 0.1 BTC if you want your lights back on
Requiem for the American Dream
Something Android does, or tries to do at least, is to have a granular permissions system for apps. Chrome should do similar for websites, where by default those things capable of causing problems are switched off. For sites that genuinely make good use of Bluetooth (and where the user is happy with this), it should be easy enough to grant permissions. In addition, when it comes to granting permissions, there is the opportunity to add information, and to hide/detect more dangerous choices.
John_Chalisque
Hey, at least he's not promoting ad-blocking with an unblockable ad.
Now that firefox has withered away and IE "edged" its marketshare into the toilet to the benefit of Chrome its time google start flexing its muscle to abuse its dominate position.
Another reason not to trust Google **anything***
All fine and good until the next browser vulnerability. Chrome is one of the better browsers security wise (at least compared to Firefox) but their is still a regular flow of vulnerabilities. Add in stupid users who click yes to anything as they don't understand the implications.
"The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript."
Forget ransomware. We're one bluetooth-enabled pacemaker away from hostageware.
"Do not step away from your computer, until you complete the following form to send us 4.9 BTC..."
I didn't find any reason for it. If there was a problem, it is gone now.
Is this even a tech blog anymore? These assumptions about privacy loss only make sense if you haven't done even the most trivial reading of the spec. The docs are here: https://developers.google.com/... A site can request to connect to a bluetooth device. Chrome prompts the user for which one (or none), and the website can then interact with the selected device. I did less than a minute's worth of research. It's even mentioned in the article, but then the article just goes on to assume that the user has granted permission to the page to access every device they have somehow. Maybe I've missed something, but nobody seems to be talking about the actual implementation.
_The UA MUST inform the user what capabilities these services give the website before asking which devices to entrust to it. If any services in the list arenâ(TM)t known to the UA, the UA MUST assume they give the site complete control over the device and inform the user of this risk. The UA MUST also allow the user to inspect what sites have access to what devices and revoke these pairings._
https://webbluetoothcg.github.io/web-bluetooth/#security-and-privacy
FUD article. Put your fucking pitchforks down.
yep, computer-controlled machines that get more and sophisticated every year so the tinfoil get thinner and thinner every year but the price still goes up...
Everything I write is lies, read between the lines.
That's cute, I don't have any blue tooth devices.
Thanks msmash (ed), it is nice to have it explained that TT stands for Profile.
I'm an American. I love this country and the freedoms that we used to have.
Bluetooth is a broad wireless technology allowing web sites now to work through Bluetooth. This is very troubling and how long before someone creates a way to turn on Bluetooth even if you have disabled it in Chrome? If the whole ideal is better tracking, that's even more concerning. But I suspect if Google has done it, the rest of the browsers will follow suit.
Firejail everything that google, fb, twitter, msft, apple, Oracle, HP, Adobe touch.
Do it now!
Why do you folks keep using google products? Seriously, you are all part of the problem.
The real question is, why is such a wall of text, posted by an AC and with a score of -1, auto-expanded to full view while some real comments are not?
The power of God.
Post ad with bluetooth crap in it.
Filter for the ones who have plenty of expensive toys.
Pillage.
Profit.
What risk is this to bluetooth keyboards & mice?
and the rest 'rest' of us want to be able to get the news without the radical neo-marxism virtue signaling woven in..
This web protocol uses the GATT protocol. That means that the bluetooth devices must be open-protocolled. Therefore, you don't have to worry about closed sourced apps, someone can always build an osx/windows/linux version.
Your ad here. Ask me how!
It seems that Sergey Brin worked for the CIA at Stanford before he spun off Google, so I really don't trust Google at all.
I'd even put more trust in Jesus than in Google, and I'm an atheist...
"Trump!!", the new Godwin.
Why do operating systems allow these things to happen in the first place is beyond me. I need to see access control lists for all applications and all devices. That way I can prevent let's say Chrome from getting anywhere near the bluetooth radio.
I wonder if this "feature" was already a part and we only know now...
From the page I linked:
I was referring to the maker of a GATT peripheral that chooses to create such "custom services" and "custom characteristics" for use only by that device and the proprietary native or web application that accompanies it.
I just re-read the article on El Reg to see if it says anything about disallowing custom (128-bit) services. Turns out it links to Google's page about the Web Bluetooth API, which states that custom services and characteristics are allowed:
I've (now) used this API to connect to some BT devices from chrome,
and this article is wildly inaccurate.
The API does not provide the ability to sniff out BT devices, nor can the web page connect to a device w/o explicit user action.
specifically, the root API call which begins the chain of device access for the page is navigator.bluetooth.requestDevice(),
which opens a chrome-managed dialog asking the user to choose & connect to a device (or not), and returns just that single device.
of course, there could be bugs in the API implementation which would allow other forms of access,
but that didn't seem to be the thrust of the article.
many folks on this story have commented "why would i want that".
that's like asking why you would want to read email in a web page instead of in a traditional native app.