search

w3c / accelerometer

Accelerometer
https://www.w3.org/TR/accelerometer/
Other
18 stars 25 forks source link

Disable Accelerometer use while Vibration API is in use #69

Open MrBrain295 opened 11 months ago

MrBrain295 commented 11 months ago

The accelerometer could be used to fingerprint people if it is used at the same time as the vibration API. This could be prevented by having the accelerometer disabled or collecting data at a lower accuracy when the vibration API is in use.

anssiko commented 11 months ago

Thanks for the proposal. The WG has discussed this type of an attack and has decided that a spec-conformant implementation may stop the sensor or reduce accuracy when the device is vibrating. These two mitigations help address not just vibration-based fingerprinting but also e.g. password skimming attacks the WG has also investigated.

While we're here, I'd like to share that this WG responsible for the Sensor APIs is chartered with a privacy focus and works with privacy researchers to analyze new attacks and specify mitigations to them. We also work with the general public and equally appreciate your contributions.

Please let us know if this satisfies your requirements or whether you'd like to suggest normative changes or informative clarifications to the specification(s). Please note the Accelerometer spec extends the Generic Sensor API spec, and it is the latter that defines the generic mitigations. Thank you.

reillyeon commented 11 months ago

Since the Vibration API requires the page to have visibility and the Accelerometer API requires the page to have focus it should already be difficult (though not impossible) for the APIs to be used at the same time.