Slashdot Mirror
Chrome 56 Quietly Added Bluetooth Snitch API (theregister.co.uk)
Richard Chirgwin, writing for The Register: When Google popped out Chrome 56 at the end of January it was keen to remind us it's making the web safer by flagging non-HTTPS sites. But Google made little effort to publicise another feature that's decidedly less friendly to privacy, because it lets websites ask about users' Bluetooth devices and harvest information from them through the browser. That's more a pitch to developers, as is clear in this YouTube video from Pete LePage of the Chrome Developers team. "Until now, the ability to communicate with Bluetooth devices has been possible only for native apps. With Chrome 56, your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API," Google shares in the video. "The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript." In other words, the API lets websites ask your browser "what Bluetooth devices can you see," find out what your fridge, and so on, is capable of, and interact with it.
http://www.jesusisprecious.org...
I have a classic book in front of me published in the year 1868, titled âoeGOD IN HISTORY and GOD IN SCIENCE,â authored by London Pastor John Cumming (1807-1881).[1] May I say kindly, there's no such thing as an atheist! Some of the world's wealthiest celebrities have the stench of Hell on them, which is where they are all going, blaspheming the very God Who is kind to them. Luke 6:35b, âoe...for he is kind unto the unthankful and to the evil.â
Legendary singer Billy Joel is a professed atheist...
âoeI gradually decided that just because I didn't have or couldn't find the ultimate answer didn't mean I was going to buy the religious fairytale. As an atheist you have to rationalize things.â â"Billy Joel
On page 139 of his book, âoeGOD IN HISTORY and GOD IN SCIENCE,â Pastor John Cumming makes a brilliant observation concerning professed atheists...
Atheism is folly as much as wickedness. But suffer me, before I show this, to say, that it is absolutely impossible that any man can be an atheist, in the strict sense of that word. All that any can say is this: âoeNo spot that I have searched does reveal a God; every organization I have examined does not show traces of wisdom, goodness, and design:â but that individual cannot say; âoeThere is no God;â because he cannot say, âoeI have soared to the farthest star, I have descended to the deepest mines, I have swept all space, and searched all time, and in the realms of infinite space I have not detected any traces of a God.â In other words, to be able to say, âoeThere is no God,â you must yourself assume to be God, which is a reductio ad absurdum, an utter and a complete absurdity.
SOURCE: âoeGOD IN HISTORY and GOD IN SCIENCE,â p. 139; by Rev. John Cumming, D.D.; New York: Published by Carlton & Lanahan; 200 Mulberry-Street; 1868.
What a brilliant observation. How can any man claim to be an atheist unless he has traveled to the farthest place in the universe? The nearest star to the earth (after our own sun) is Alpha Centauri, which is 4.37 light-years away (28,200,000,000,000 miles away!). This is just one star, being the closest to earth besides our own sun, which is 93,000,000,000 miles away. My friend, the Hubble Space Telescope has discovered that there are at least 200,000,000,000 galaxies in the universe. And each of those galaxies contains BILLIONS of stars! It is anticipated that when the James Webb Telescope is launched in 2018 from NASA, that it will discover over ONE TRILLION GALAXIES!!!
The Word of God teaches that God made the stars. I love how Genesis 1:16 is written... âoeHE MADE THE STARS ALSO.â It's like the Bible is saying, âoeOh, by the way, God also made all the stars!â Genesis 1:16, âoeAnd God made two great lights; the greater light to rule the day, and the lesser light to rule the night: he made the stars also.â God is amazing, Who knows the exact number of stars that He created, and he calls them each by their own name. Amen! Psalms 147:4, âoeHe telleth the number of the stars; he calleth them all by their names.â I have just briefly discussed the stars. The world that exists under a microscope is even more amazing, complex and a mystery to mankind. How can anyone reasonably claim to be an atheist when man hasn't even discovered what's in 90% of the earth's oceans? Pastor John Cumming is so right... For anyone to say, âoeThere is no God!,â you must yourself assume to be God! No human being has traveled to the ends of the u
Will this affect Chromium as well?
Prepare for the era of Bluetooth spam 2.0. Now, you don't even need to buy spammer hardware from Chinese, just write a website with bt spam script.
Now that pop-up blockers are really good (well, they don't fully block javascript screen blocks yet), we'll have to deal with ads flashing your room lights to match whatever auto-play video they've forced in your face. Can't wait for the first lawsuit when someone has a seizure or when a site dim the lights and someone stubs their toe.
You have no _idea_ what my fridge is capable of.
So despite all ad blocking efforts from the user, this API provides a great pathway to do some digital fingerprinting and establish a cross-site identity. And if you happen to log in on certain sites that use this, they will be able to establish your real identity on any other site from there on in as well.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
Laugh all you want, but I'll be using Firefox Aurora on my phone. Chrome isn't even installed.
Any suggestions for other good mobile browsers?
Google has gone completely bat-shit insane. How on earth did they think this was a good idea, let alone actually go forward and implement such a thing in the release product?
Just mind-boggling.
"Excuse me, I'm from the computer services group, and your A/C appears to be acting up... It's reporting . Please go to this website and click 'Accept' to all the prompts and we can diagnose it remotely".
Yea, no problem catching idiots with that...
This will be the first thing I block.
I just got done setting up a heart rate monitor on a machine at a clinic where we use a web based software package on firefox. The bluetooth stuff is one of the last things requiring a native application. I wonder how much longer we'll need any native software at all with stuff like this coming out.
I'll be honest, I just don't get the appeal. What the fuck do my appliances need connectivity for?
Mod me down with all of your hatred and your journey towards the dark side will be complete!
And of course this won't be used to better refine browser fingerprinting techniques. At all.
your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API
Given the fact that even the battery API was abandoned for privacy reasons, I just don't believe it is ever possible to do this securely and privately. This is just an attack vector begging to be exploited.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
I was just about to upmod it - I thought this guy was going for a "+5, Funny".
This is complete opposite from "Don't be evil". This is outright intrusive and evil.
Given the fact that even the battery API was abandoned for privacy reasons, I just don't believe it is ever possible to do this securely and privately.
Chrome allows filesystem access. You give permission for an app to access a specific location in your filesystem. I don't see why you can't just be asked whether you want to give permission to do Bluetooth things, through the same mechanism.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Google has gone completely bat-shit insane.
Insane like a fox.
You must think that you are their target customer.
Silly. Using a computer is an attack vector. Go live in the mountains tinhatfoilboiiiiii.
So despite all ad blocking efforts from the user, this API provides a great pathway to do some digital fingerprinting and establish a cross-site identity.
You are aware that Google is an advertising company right? People tend to forget this fact and how it will tend to incentivize them as an organization. Your privacy is really of no concern to them unless it creates a PR problem.
ActiveX.
Good luck with that. We will need it.
Lisias@Earth.SolarSystem.OrionArm.MilkyWay.Local.Virgo.Universe.org
How long before the criminals use the Bluetooth connection to turn off various important household systems? When it's -10 degrees F/ -23 C in the upper Midwest of the US and in Canada it is highly inconvenient to get a message to the effect that "Your Carrier Xfinity Furnace has been turned off and locked by us by remotely disabling the furnace control board firmware. To receive the code to unlock it and restore heat in your house, please submit 2 Bitcoin (about US$ 2000) to the following account before your pipes and your family freeze. And by the way, we also opened your garage door for your convenience and more rapid cooling." I would be very interested to know how to disable the Bluetooth API in the new versions of Chrome/Chromium. (I run both).
Would you prefer that only native apps be able to access Bluetooth devices? Then companies will just make the required native app exclusive to the operating system other than the one that your PC runs. For example, one company might be tempted to make a device's corresponding native app exclusive to macOS. Another might be tempted to make its own exclusive to Windows.
This reminds of the good old days when you could run code in documents and infect people with them. The only difference is that at least in that case, this was limited only to documents and only from microsoft. Nowadays, since everything is being to pushed to the web, this is much worse.
Avantgarde Hebrew science fiction
...provided that the user is informed when a website wants to use it and it's strictly opt in. Firefox works this way regarding sharing of location information.
My point is that everything that lessens the dependence on native apps is good because then it's less difficult to change platforms.
Google is the new Microsoft which was the computer equivalent of the Fuller Brush salesman shoving his foot in your door. I hope this is OFF by default.
Some drink at the fountain of knowledge. Others just gargle.
The difference being that filesystem access is still gated by the OS.
-- Sometimes you have to turn the lights off in order to see.
But you can't even trust the tin foil since it's been made with computer-controlled machines.
#DeleteFacebook
bluetooths range kinda sucks and even more so with walls though. :/
Did you register that fancy new Bluetooth appliance for the manufacturer's warranty? Because if you did, now Google can obtain your exact physical location any time it wants.
No, I prefer that no software except the Bluetooth driver recognize a device as being Bluetooth. As far as any application can tell, a Bluetooth headset with microphone should be indistinguishable from any other stereo audio output and mono audio input.
That works because your PC's operating system is aware of "stereo audio output" and "mono audio input" as a device class. Are the major PC operating systems aware of, say, "CNC mill" or "3D printer" as a device class yet?
Good luck compiling "auditable source code" that depends on Cocoa for anything other than macOS, particularly if it depends on the parts of Cocoa that GNUstep doesn't replicate. Or vice versa: Good luck compiling a Win32 application and device driver on macOS or Linux. (Wine doesn't run drivers.)
or 0.1 BTC if you want your lights back on
Requiem for the American Dream
Something Android does, or tries to do at least, is to have a granular permissions system for apps. Chrome should do similar for websites, where by default those things capable of causing problems are switched off. For sites that genuinely make good use of Bluetooth (and where the user is happy with this), it should be easy enough to grant permissions. In addition, when it comes to granting permissions, there is the opportunity to add information, and to hide/detect more dangerous choices.
John_Chalisque
Now that firefox has withered away and IE "edged" its marketshare into the toilet to the benefit of Chrome its time google start flexing its muscle to abuse its dominate position.
Another reason not to trust Google **anything***
All fine and good until the next browser vulnerability. Chrome is one of the better browsers security wise (at least compared to Firefox) but their is still a regular flow of vulnerabilities. Add in stupid users who click yes to anything as they don't understand the implications.
"The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript."
Forget ransomware. We're one bluetooth-enabled pacemaker away from hostageware.
"Do not step away from your computer, until you complete the following form to send us 4.9 BTC..."
Is this even a tech blog anymore? These assumptions about privacy loss only make sense if you haven't done even the most trivial reading of the spec. The docs are here: https://developers.google.com/... A site can request to connect to a bluetooth device. Chrome prompts the user for which one (or none), and the website can then interact with the selected device. I did less than a minute's worth of research. It's even mentioned in the article, but then the article just goes on to assume that the user has granted permission to the page to access every device they have somehow. Maybe I've missed something, but nobody seems to be talking about the actual implementation.
_The UA MUST inform the user what capabilities these services give the website before asking which devices to entrust to it. If any services in the list arenâ(TM)t known to the UA, the UA MUST assume they give the site complete control over the device and inform the user of this risk. The UA MUST also allow the user to inspect what sites have access to what devices and revoke these pairings._
https://webbluetoothcg.github.io/web-bluetooth/#security-and-privacy
FUD article. Put your fucking pitchforks down.
yep, computer-controlled machines that get more and sophisticated every year so the tinfoil get thinner and thinner every year but the price still goes up...
Everything I write is lies, read between the lines.
That's cute, I don't have any blue tooth devices.
Thanks msmash (ed), it is nice to have it explained that TT stands for Profile.
I'm an American. I love this country and the freedoms that we used to have.
Bluetooth is a broad wireless technology allowing web sites now to work through Bluetooth. This is very troubling and how long before someone creates a way to turn on Bluetooth even if you have disabled it in Chrome? If the whole ideal is better tracking, that's even more concerning. But I suspect if Google has done it, the rest of the browsers will follow suit.
Firejail everything that google, fb, twitter, msft, apple, Oracle, HP, Adobe touch.
Do it now!
Why do you folks keep using google products? Seriously, you are all part of the problem.
Post ad with bluetooth crap in it.
Filter for the ones who have plenty of expensive toys.
Pillage.
Profit.
What risk is this to bluetooth keyboards & mice?
This web protocol uses the GATT protocol. That means that the bluetooth devices must be open-protocolled. Therefore, you don't have to worry about closed sourced apps, someone can always build an osx/windows/linux version.
Your ad here. Ask me how!
It seems that Sergey Brin worked for the CIA at Stanford before he spun off Google, so I really don't trust Google at all.
I'd even put more trust in Jesus than in Google, and I'm an atheist...
"Trump!!", the new Godwin.
Why do operating systems allow these things to happen in the first place is beyond me. I need to see access control lists for all applications and all devices. That way I can prevent let's say Chrome from getting anywhere near the bluetooth radio.
I wonder if this "feature" was already a part and we only know now...
From the page I linked:
I was referring to the maker of a GATT peripheral that chooses to create such "custom services" and "custom characteristics" for use only by that device and the proprietary native or web application that accompanies it.
I just re-read the article on El Reg to see if it says anything about disallowing custom (128-bit) services. Turns out it links to Google's page about the Web Bluetooth API, which states that custom services and characteristics are allowed:
I've (now) used this API to connect to some BT devices from chrome,
and this article is wildly inaccurate.
The API does not provide the ability to sniff out BT devices, nor can the web page connect to a device w/o explicit user action.
specifically, the root API call which begins the chain of device access for the page is navigator.bluetooth.requestDevice(),
which opens a chrome-managed dialog asking the user to choose & connect to a device (or not), and returns just that single device.
of course, there could be bugs in the API implementation which would allow other forms of access,
but that didn't seem to be the thrust of the article.
many folks on this story have commented "why would i want that".
that's like asking why you would want to read email in a web page instead of in a traditional native app.