Firefox Gets Privacy Boost By Disabling Proximity and Ambient Light Sensor APIs

[Prorootect]

Firefox Gets Privacy Boost By Disabling Proximity and Ambient Light Sensor APIs
bleepingcomputer.com/news/software: Firefox Gets Privacy Boost By Disabling Proximity and Ambient Light Sensor APIs
By
Catalin Cimpanu - March 12, 2018

Stating with Firefox 60 —expected to be released in May 2018— websites won't be able to use Firefox to access data from sensors that provide proximity distances and ambient light information.

Firefox was allowing websites to access this data via the W3C Proximity and Ambient Light APIs.

But at the start of the month, Mozilla engineers have decided to disable access to these two APIs by default. The APIs won't be removed, but their status is now controlled by two Firefox flags that will ship disabled by default.

This means users will have to manually enable the two flags before any website can use Firefox to extract proximity and ambient light data from the device's underlying sensors.

A total of five new flags added
The two flags will be available in Firefox's about:config settings page. The screenshot below shows the latest Firefox Nightly version, where the two flags are now disabled, while other sensor APIs are enabled.

device.sensors.proximity.enabled
device.sensors.ambientLight.enabled

The Firefox code commit in which these two flags have been added also includes three other flags —to enable or disable all sensors APIs, to enable/disable the Device Orientation Sensor API, and to enable/disable the Motion Sensor API.

device.sensors.enabled
device.sensors.orientation.enabled
device.sensors.motion.enabled
These three flags will ship enabled by default, as access to these two APIs is needed by a broad range of a wide range of mobile websites.

Privacy concerns over the Proximity and Ambient Light APIs
The Proximity and Ambient Light sensors are both new and highly controversial. A key factor in the decision to ship these two APIs disabled by default is the work of privacy expert Lukasz Olejnik.

Olejnik published two research reports on the possible ways attackers and advertisers could abuse these two APIs.

For example, Olejnik argued that the W3C Proximity Sensor API could allow websites and advertisers to query the position of nearby objects in relation to a user's smartphone or tablet. Additionally, he also argued that malicious sites could use the W3C Ambient Light Sensor API to steal browser data.

Shipping these two APIs off by default takes care of some of Olejnik's concerns, albeit it does not mitigate the risk altogether.

"More user control is always good," Olejnik said regarding Mozilla's decision.

 

[DavidLMO]

Wonder WTH the other 3 do? [scratches head]

 

[Vasudev]

Wonder WTH the other 3 do? [scratches head]

If you use LineageOS then gestures can be used, say getting the phone out of the pocket will light up the display with brief notifications.

 

[DavidLMO]

I do not have a smart phone so I do not understand half of what I read.

 

[Vasudev]

I do not have a smart phone so I do not understand half of what I read.

Do you use Nokia 3310 or some other?
Never liked smartphones eventhough I have one.
In simple terms, motion allows an app to take a reading your steps and also track location (if location is turned ON be it GPS,BT or Wifi). Orientation allows the app to go into portrait or landscape mode using orientation and accelerometer.

 

[DavidLMO]

GAHHHHHHHHHHHHHHHHHH I have an old dumb LG And I have only sent 1 text message in my life. heh Thanks for the info.

So I take it all that sensor crap in FF is oriented to tablets or phones?

 

[Vasudev]

GAHHHHHHHHHHHHHHHHHH I have an old dumb LG And I have only sent 1 text message in my life. heh Thanks for the info.

So I take it all that sensor crap in FF is oriented to tablets or phones?

Tabs,phones, 2in 1 laptops, Microsoft surface pro or book, Lenovo Yoga or similar.

 

[Prorootect]

Tabs,phones, 2in 1 laptops, Microsoft surface pro or book, Lenovo Yoga or similar.

Nothing for me.
Uh, why I posted this topic, not for me...but for others.

 

[Ink]

Chrome users fear not.

Generic Sensor - Disabled

Enables motion sensor classes based on Generic Sensor API, i.e. Accelerometer, LinearAccelerationSensor, Gyroscope, AbsoluteOrientationSensor and RelativeOrientationSensor interfaces.​

chrome://flags#enable-generic-sensor

Generic Sensor Extra Classes - Disabled

Enables an extra set of sensor classes based on Generic Sensor API, which expose previously unavailable platform features, i.e. AmbientLightSensor and Magnetometer interfaces.​

chrome://flags#enable-generic-sensor-extra-classes

About: Sensors For The Web! | Web | Google Developers

More interesting Chrome://Flags here - Google - List of interesting experimental flags for Google Chrome