Slashdot Mirror
Mobile Websites Can Tap Into Your Phone's Sensors Without Asking (wired.com)
When apps wants to access data from your smartphone's motion or light sensors, they often make that capability clear. That keeps a fitness app, say, from counting your steps without your knowledge. But a team of researchers has discovered that the rules don't apply to websites loaded in mobile browsers, which can often access an array of device sensors without any notifications or permissions whatsoever. From a report: That mobile browsers offer developers access to sensors isn't necessarily problematic on its own. It's what helps those services automatically adjust their layout, for example, when you switch your phone's orientation. And the World Wide Web Consortium standards body has codified how web applications can access sensor data. But the researchers -- Anupam Das of North Carolina State University, Gunes Acar of Princeton University, Nikita Borisov of the University of Illinois at Urbana-Champaign, and Amogh Pradeep of Northeastern University -- found that the standards allow for unfettered access to certain sensors. And sites are using it.
The researchers found that of the top 100,000 sites -- as ranked by Amazon-owned analytics company Alexa -- 3,695 incorporate scripts that tap into one or more of these accessible mobile sensors. That includes plenty of big names, including Wayfair, Priceline.com, and Kayak.
The researchers found that of the top 100,000 sites -- as ranked by Amazon-owned analytics company Alexa -- 3,695 incorporate scripts that tap into one or more of these accessible mobile sensors. That includes plenty of big names, including Wayfair, Priceline.com, and Kayak.
So you condone raping children? Nice.
I am still confused to why my web browser needs access to my sensors in the first place.
Or pretty anything that isn't the temp and appdata folder. It can have access to that.
Hah! Now I feel smug that the only working browser on my phone has no vulnerabilities of this kind at all.
Backporting a modern bloated browser for a system this old would be a massive task, and Nokia ended support for N900 ages ago. Never had the time to manage to get working one of community-made distributions made in the last few years, so it's elinks on the phone for me. I dare not to even contemplate Firefox or Chrome running on 256MB RAM. They're the reason why riscv has a 128-bit version...
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
the lynks browser for android doesn't have this issue.
Chrome, webview and Firefox (and vendor browsers) are problematic unless you have large amounts of extensions installed, with blocklists updated hourly...
So you condone raping children? Nice.
-
Obviously you are stupid.
I don't believe the accusations against Kavanaugh.
I believe Blasey Ford's efforts are 100% politically motivated.
You should watch your mouth. If you said "you condone raping children" to me in a bar, I'd teach you a hard lesson.
Then you're an idiot.
Kavanaugh is a rapist. He should be in prison, not on the SCOTUS.
The article starts by claiming that apps require some permission from the user before they can use these sensors in question. Motion, orientation, proximity, light. That's not true on Android. Good night!
He may go to prison in the end, we'll see. He perjured himself!
The internet, and especially on a mobile device, has become a shithole of ads, trackers, analytics, and bad actors. Much of that is facilitated by the shit-storm of javascript from 20+ different 3rd party stuff.
There is no defensible reason for a fucking web page to have any access to any of the sensors on a phone. While the browser might need to know that the orientation has changed, the website doesn't.
This is why I don't use mobile devices for this crap, and why I don't use social media at all .. because the sites themselves are ran by assholes, and the rest of the tracking pretty much guarantees you are going to be far more invasive tracked than you could possibly recognize.
I find it hilarious that this gem is coming from Amazon, who are also one of the asshole players in the ad and analytics market.
Sorry, I'll stick with a browser on my desktop, with every possible blocker to shut out the ads and trackers.
I don't care about your business model, and I care even less when you embed 3rd party shit to spy on me and act like I've given them all permission by using your site. Sorry, but no, that never actually happened.
The overwhelming majority of sites are ran by assholes, or at least by people who have allowed the assholes to catch a free ride. I'm not allowing that shit.
And my browser doesn't have access to unnecessary sensor info.
Then you're an idiot.
-
You're just a punkass bitch who sucks the cock of "news" propaganda like it was your mommy's tit.
Do the world a favor and slit your wrists.
... permission to access various parts of your phone, you also giving that same permission to everything that runs in the browser?
I wonder if enough information can be teased out of the motion sensor to determine if a user is walking, then use that to establish a bio-metric identifier with any confidence from gait analysis. At a minimum an informed statistical guess about the owner's height might be possible.
Tell it to the warden, Trump traitor.
Quoting Wired Magazine: "Mac OS X, in turn, gave rise to the mobile iOS. Both Apple operating systems still include code files tagged with the NeXt name – and both are directly descended from a version of UNIX called the Berkeley System Distribution, or BSD, created at the University of California, Berkeley in 1977" BSD isn't quite dead yet. It lives on in 2 Billion iOS devices and the odd iMac or MacBook.
BSD isn't dead. It just smells that way.
That was me. I farted.
Gee whiz, fella. Whew! Something must havef died up there! That gas was rank. You better see a doctor PDQ!
The browser is an app. And I can close my tabs (although service workers can throw a wrench into that). I much prefer the browser model to the app model. I install almost no apps on my phone and use the browser.
For things I care about (I don't care about my GPS coordinates, btw) I don't give the browser permission -- e.g. record video/audio. Problem solved.
What. A. Wuss.
Wait, didn't he just claim he was a virgin until after college?
Article is unclear. Must be Android thing.
https://sensor-js.xyz/demo.htm...
Indeed it works on my iPhone. Javascript can read Orientation, Accelerometer (including gravity) and Gyroscope sensors in real time.
no no, you misunderstand.. he worked hard at pretending he was a virgin. Did you know? it was legal for seniors to drink at that time... never mind the fact he wasn't a senior and it wasn't legal for him to drink. I don't want a Judge who intentionally gives misleading arguments.
The browser can access whatever it wants!
about:config -> search "sensors" -> disable them all