08-06-2015, 11:41 AM
Your smartphone and laptop battery life could endanger your privacy
Think your private browsing session is really private? A new paper shows how your smartphone or laptop's battery can be used to compromise your privacy.
A HTML5 feature called the Battery Status API lets websites check the status of your device's battery with such precision that it could be used to track you in short time intervals, researchers claim. And that's even if you're using identity-concealing software such as Tor.
This happens because the Battery Status API can pull several pieces of information about your device's battery — level, charging time and discharging time. Combined, this data is nearly unique for each device, meaning it allows potential attackers to create a digital fingerprint of your device and track your activities on the web.
"In short time intervals, Battery Status API can be used to reinstantiate tracking identifiers of users, similar to evercookies.Moreover, battery information can be used in cases where a user can go to great lengths to clear her evercookies. In a corporate setting, where devices share similar characteristics and IP addresses, the battery information can be used to distinguish devices behind a NAT, of traditional tracking mechanisms do not work," the paper claims.
The paper, signed by French and Belgian security researchers Lukasz Olejnik, Gunes Acar, Claude Castelluccia, and Claudia Diaz, and first reported on by The Guardian, claims that, as of June 2015, Firefox, Opera and Chrome support the HTML5 feature.
This sort of tracking would be very hard to escape, since practically all devices are vulnerable. The risk is, however, higher for old or used batteries with reduced capacities.
According to the paper, the potential privacy issues of the Battery Status API have been discussed as early as 2012, but the API was not revised to alleviate them.
The issue is extremely easy to fix, researchers argue: Just make the battery readings less precise. By rounding the values down, none of the functionality would be lost, but it would be nearly impossible to track a user down.
http://mashable.com/2015/08/04/battery-privacy-html5/
Think your private browsing session is really private? A new paper shows how your smartphone or laptop's battery can be used to compromise your privacy.
A HTML5 feature called the Battery Status API lets websites check the status of your device's battery with such precision that it could be used to track you in short time intervals, researchers claim. And that's even if you're using identity-concealing software such as Tor.
This happens because the Battery Status API can pull several pieces of information about your device's battery — level, charging time and discharging time. Combined, this data is nearly unique for each device, meaning it allows potential attackers to create a digital fingerprint of your device and track your activities on the web.
"In short time intervals, Battery Status API can be used to reinstantiate tracking identifiers of users, similar to evercookies.Moreover, battery information can be used in cases where a user can go to great lengths to clear her evercookies. In a corporate setting, where devices share similar characteristics and IP addresses, the battery information can be used to distinguish devices behind a NAT, of traditional tracking mechanisms do not work," the paper claims.
The paper, signed by French and Belgian security researchers Lukasz Olejnik, Gunes Acar, Claude Castelluccia, and Claudia Diaz, and first reported on by The Guardian, claims that, as of June 2015, Firefox, Opera and Chrome support the HTML5 feature.
This sort of tracking would be very hard to escape, since practically all devices are vulnerable. The risk is, however, higher for old or used batteries with reduced capacities.
According to the paper, the potential privacy issues of the Battery Status API have been discussed as early as 2012, but the API was not revised to alleviate them.
The issue is extremely easy to fix, researchers argue: Just make the battery readings less precise. By rounding the values down, none of the functionality would be lost, but it would be nearly impossible to track a user down.
http://mashable.com/2015/08/04/battery-privacy-html5/
