[HN Gopher] This page knows your battery charge level (unless yo...
___________________________________________________________________
This page knows your battery charge level (unless you're using
Firefox)
Author : popcalc
Score : 43 points
Date : 2023-11-25 20:55 UTC (2 hours ago)
(HTM) web link (deepesh-01.github.io)
(TXT) w3m dump (deepesh-01.github.io)
| daliusd wrote:
| On iOS Safari: it looks like it does not know either
| sampli wrote:
| On iOS brave: doesn't work
| YeahThisIsMe wrote:
| I hate the internet now.
| superkuh wrote:
| With the usual qualification that you have to have your browser
| set to automatically execute javascript code from random
| untrusted websites.
| askonomm wrote:
| So ... the default settings of most browsers? The way you
| phrased your sentence makes it seem as if users themselves set
| their browser up like that, when that is not the case.
| superkuh wrote:
| Yup. The defaults and expectations for the commercial web are
| terrible. Since this is a technical forum I assume most of as
| aren't running our browsers that way.
| askonomm wrote:
| I doubt most of us turn off javascript, and enable it on a
| case by case basis, regardless if it's a technical forum or
| not. I certainly don't. That would be a major inconvenience
| to do for very little benefit, imo.
| OfSanguineFire wrote:
| "Most of us" probably not, but a lot of us. NoScript is
| one of the most popular Firefox extensions in nerd
| circles. Also makes a huge difference when browsing on
| old hardware or from a connection where data is pricey.
| LegibleCrimson wrote:
| I used to (NoScript, then uMatrix for years), but it is a
| ton of work. Just blocking problem scripts with uBlock
| Origin gets you 95% of and way there. The last 5% is a
| lot of extra effort for seriously diminishing returns.
| eyelidlessness wrote:
| That's a really surprising assumption.
| whatevaa wrote:
| Assumptions are usually wrong unless verified.
| _ache_ wrote:
| Which is the default for the vast majority of users.
| HtmlProgrammer wrote:
| While I admire your dedication to privacy by disabling
| JavaScript, personally I've gone crazy and given up due to all
| the people around me in my life forcing me to live in a privacy
| nightmare
| zimpenfish wrote:
| Doesn't seem to work on Safari (desktop or mobile) - I just get
| the continuous blue animation. Chrome on macOS did report the
| correct battery level though.
| starefossen wrote:
| Same here.
| chipotle_coyote wrote:
| Yes, I think the correct headline is "This page knows your
| battery charge level if you're using Chrome or most Chrome-
| based browsers". (I'm not sure if it works on all of them,
| although it does work on Arc.)
| elliotec wrote:
| Doesn't work on brave.
| rpastuszak wrote:
| Does brave employ any anti fingerprinting measures?
| goryramsy wrote:
| Yes.
| Obscurity4340 wrote:
| Represent ;)
| bonestamp2 wrote:
| Works on brave for me. Any idea what setting prevents this?
| k8sToGo wrote:
| Not having a battery
| elliotec wrote:
| Do you have shields on?
| bonestamp2 wrote:
| Yes, it says Shields are up for that page (the default
| until you say otherwise as far as I know). Fingerprint
| blocking is on. I disabled all cookies and it still
| works. I tried Safari and it is not working there. Pretty
| strange. v1.60.118
| silisili wrote:
| Brave for Android here. It justs reports that it's
| charging and 100%, neither of which are true. No
| extensions or weird settings.
| rcostin2k2 wrote:
| Neither on Brave / Windows 11 (notebook)
| hoistbypetard wrote:
| It didn't work on Safari (desktop or mobile), Brave, Librewolf
| or Firefox for me. It worked on Chrome and Vivaldi.
| moffkalast wrote:
| On desktop Chrome it gives me a "Charging 100%" blue animation,
| which I suppose is technically correct.
| jakub_g wrote:
| The API is only supported in Chromium browsers [0]. It was
| removed from Firefox and Safari.
|
| https://developer.mozilla.org/en-US/docs/Web/API/Battery_Sta...
| zimpenfish wrote:
| Somewhat disappointed in macOS for giving the information to
| Chrome. I'd figure that to be the kind of sensor you need a
| special entitlement to read (but it may well be tricky to
| enforce.)
| internetter wrote:
| Some browsers activate a low power mode when your battery
| reaches a certain threshold
| 7734128 wrote:
| Correct on Kiwi on Android.
| hyperluz wrote:
| Not working on ipad. (tested Chrome and Safari)
| Rebelgecko wrote:
| Doesn't seem to work with lynx
| schappim wrote:
| Neither does JavaScript :-)
| maxk42 wrote:
| lynx has robust javascript support.
| whynotmaybe wrote:
| Ddg android doesn't show it
| DiogoRolo wrote:
| Doesn't work on Brave
| afavour wrote:
| As best I can tell this only works in Chrome despite the title
| implying Safari would be at fault.
|
| Worth pointing out though that iOS native apps appear to have
| this information with no permission prompt:
|
| https://stackoverflow.com/a/12346650
| Dwedit wrote:
| navigator.getBattery()
| _ache_ wrote:
| Basically: navigator.getBattery().then(battery =>
| console.log(`Battery level: ${battery.level \* 100}%`))
|
| C.f.: https://developer.mozilla.org/en-
| US/docs/Web/API/Battery_Sta...
| rvnx wrote:
| Works as expected, the same way there are APIs for the device
| orientation, etc.
|
| Eventually these get placed behind permissions if they become
| too much widely abused.
|
| As explained in the standards:
|
| "This can be used to adjust your app's resource usage to reduce
| battery drain when the battery is low, or to save changes
| before the battery runs out in order to prevent data loss".
| cantSpellSober wrote:
| I believe this _is_ behind permissions, the Permissions-
| Policy directive "battery"
| kallistisoft wrote:
| Doesn't respond to charging status change events even though an
| .onCharging call back has been set. Chromium 117.0 on Linux
| charcircuit wrote:
| This API for apps to stop being a power hog if you are at low
| battery or you aren't charging the device.
| mediumsmart wrote:
| unless not using chrome maybe
| rany_ wrote:
| I'd expect this to be pitched as a way for a site to figure out
| whether to try to save power, but this begs the question why not
| just add an API to get power saving mode state?
| 1vuio0pswjnm7 wrote:
| Doesn't work without Javascript.
|
| Software I use to make HTTP requests does not support Javascript.
| xeckr wrote:
| Doesn't work when I look at a printout of the page either.
| xanderlewis wrote:
| I thought it was going to do something really weird and clever
| like use some other available measurement or input as a proxy for
| battery level. Like measuring CPU performance over time or
| temperature changes or something.
| esprehn wrote:
| This is a (very old) browser API: https://www.w3.org/TR/2014/CR-
| battery-status-20141209/
|
| It was once implemented in Firefox too and then disabled outside
| internal pages. It's from an era of trying to standardize all the
| APIs needed for Firefox OS apps: https://caniuse.com/battery-
| status
|
| Both iOS and Android apps have this capability, ex.
| https://developer.apple.com/documentation/uikit/uidevice/162...
|
| Since the entropy is coarse over the entire population you could
| debate the privacy implications (ex. Time zone is more specific
| and stable). Restricting it to only saved PWAs to match the
| privacy model of native apps seems reasonable though. Someone
| should propose the change to Chrome.
| duskwuff wrote:
| > ex. Time zone is more specific and stable
|
| Time zone is also much less useful for fingerprinting because
| it's tightly correlated with other signals like IP location and
| language preference. If you already know that a user's IP is
| somewhere in California, the additional information that
| they're using the Pacific time zone adds very little value.
| ec109685 wrote:
| Firefox and Safari obviously see the finger printing capabilities
| of this API and thus block.
| cantSpellSober wrote:
| It was in both since about 2012. Removed from Firefox in 2016:
|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1313580
|
| Removed from Webkit (Safari) soon after:
|
| https://webkit.org/tracking-prevention/
|
| Chrome took a middle ground, removing it for insecure origins
| and reducing the precision:
|
| https://chromestatus.com/feature/4878376799043584
| baz00 wrote:
| It doesn't on Edge. On my desktop machine. Which doesn't have a
| battery.
| nittanymount wrote:
| expose this without user permission ? seems an issue !
| jakub_g wrote:
| For historical context, check this paper: https://ceur-
| ws.org/Vol-1873/IWPE17_paper_18.pdf (page 3 has timeline of
| events).
|
| The API was implemented in Firefox, Safari, Chrome but it
| returned too precise data, so by reading battery status on two
| different pages and seeing the same very precise value, it was
| like having a tracking cookie.
|
| Firefox and Safari decided to pull the API altogether.
|
| An obvious fix while keeping the API would be to make the data
| less precise, i.e. round to nearest 10% or so. Still there's
| potential to abuse, and around the time there were news from Uber
| study that people with low battery could pay more for taxi, which
| was the nail to the coffin.
|
| Since then, there was quite a change in how new web APIs are
| shipped, they all come through privacy design review.
|
| Which went a bit ridiculous into the other extreme, like
| detecting if user uses dark mode reveals a whole one bit of
| information (darkmode = true | false) so it's not sent
| automatically, you need to ask for this info via a specific
| header, which means you can't know that on the first visit of the
| user on the website (and not on the first visit in incognito
| mode), only on subsequent visits. Duh.
|
| Chromium still supports the Battery API, with some rounding
| implemented.
|
| Note: Google's goal is to basically have all kinds of native APIs
| available on the web, to make the web rival with native apps, so
| they are very unlikely to remove things from the web in Chromium.
| ta1243 wrote:
| > news from Uber study that people with low battery could pay
| more for taxi, which was the nail to the coffin.
|
| Yet people still claim "I have nothing to hide" when it comes
| to concerns about privacy. When your battery level can be
| weaponised against you by multi-billion dollar companies,
| everything can be.
| charcircuit wrote:
| People still would have to agree to the price. If it is too
| high they will not accept. By having more information Uber
| would be able to make better offers. Hiding information for
| financial gain, getting a better deal, is fraud.
| whstl wrote:
| _> "People still would have to agree to the price. If it is
| too high they will not accept"_
|
| Such bullshit. If I have to go somewhere and my battery is
| about to die, I don't really have much of a choice.
|
| _> "Hiding information for financial gain, getting a
| better deal, is fraud."_
|
| Doesn't this goes both ways? "Hiding information" is
| precisely what Uber is doing, when they don't transparently
| disclose 100% of the information used to determine price
| with a customer.
|
| And no, not disclosing whether I have good battery
| percentage or not is not "hiding information", except in
| the most uncharitable interpretation possible. Uber doesn't
| have the right to know everything about me just because
| they're potentially providing a service.
| exo762 wrote:
| > Hiding information for financial gain, getting a better
| deal, is fraud.
|
| In what world? While your take is wrong, I just wonder
| where could you get this idea from?
| 15457345234 wrote:
| Their userprofile screams contrarian/clown/joker; I
| wouldn't take this bait, you'll be the fish and they'll
| enjoy it too much
| Adverblessly wrote:
| If hiding your battery level from Uber is fraud, then 100%
| of all transactions involve fraud.
| Espressosaurus wrote:
| I just don't understand what legitimate use a web page has for
| knowing the device battery level. This feels very much like
| information harvesting for the sake of information harvesting.
| jakub_g wrote:
| - Whatsapp mobile native app warns the user (and the other
| party of the call) when your battery level gets very low, to
| expect the end of the call. One could image similar webapps
| could do the same.
|
| - Warn the user to save their data when the battery level is
| too low (or automatically save) etc.
|
| (Of course, there's is 0.1% of webapps/websites who'd need
| this).
| cantSpellSober wrote:
| Good question, the paper says:
|
| > The benign uses of the API were primarily from two third
| parties: YouTube, where the API was used in performance
| metrics for embedded videos, and Boomerang, a performance
| measurement library
| internetter wrote:
| Both of these don't strike me as benign
| cantSpellSober wrote:
| Why not? Measuring your video player's battery usage
| could be used to improve its performance.
|
| For a performance measurement library, the use is
| obvious.
| internetter wrote:
| Because analytic collection is often ridiculous. The
| YouTube video player should use the standard video
| player, but they want to shove all their nonsense on top
| of it
| arbol wrote:
| Determining whether it is reasonable to ask a device to
| perform a battery intensive operation such as this:
| https://arxiv.org/abs/1911.07649
| internetter wrote:
| Why not just ask the user if they are willing for a battery
| intensive task to be performed?
|
| Worst case, api should return 3 states: Draining, Charging,
| Charging & Full
| stalfosknight wrote:
| Or unless you're using Safari.
| solardev wrote:
| Weird, doesn't work for me on Chrome on a Pixel
| glitchc wrote:
| Doesn't work on Vanadium
| binbag wrote:
| It doesn't
| iou wrote:
| Needs retitling to "Chrome and derivative browsers know your
| battery charging level"
___________________________________________________________________
(page generated 2023-11-25 23:02 UTC)