3 ms·

That’s a really neat trick but actually not so obscure. I would have thought Apple would catch it, this is actually a huge miss by their security team. It’s not

by zaroth 7y ago

That’s a really neat trick but actually not so obscure. I would have thought Apple would catch it, this is actually a huge miss by their security team. It’s not the first abuse of browser APIs used to fingerprint a device (e.g. Battery API) and won’t be the last. Any kind of ability to sample data from a device should be thoroughly analyzed for fingerprinting side-channels as part of the underlying specification as a mandatory section. Is this not actually done? Is there any kind of similar calibration that is done on thr camera sensor (e.g. for color correction) that can be teased out of the resultant image files? What about in RAW mode? How about a sound recording? Does the microphone have any kind of correction factors you might be able to observe somehow? Similarly for color temperature of the screen. Maybe there is an unexpected side-channel to get at those correction values as well, although this one seems trickier because how would you sample the screen output remotely?

maddyboo 7y ago
The distinction with accelerometer data is that some platforms do not require the user to grant permission to access, as opposed to camera/microphone access. Apparently, prior to iOS 12.2, Apple did not require the user to grant a website permission to access motion & orientation sensor data [1]. They have since introduced an off-by-default toggle to globally enable access to this sensor data. Unfortunately, it seems to be all-or-nothing - if you want to allow any site access to this data, you need to allow every site access to this data. Hopefully this is a temporary band-aid fix and Apple will introduce per-site permission a la camera/microphone/location permission prompts. I wonder if any other data sources exist which don’t require user permission. [1] https://www.macrumors.com/2019/02/04/ios-12-2-safari-motion-orientation-access-toggle/ https://www.macrumors.com/2019/02/04/ios-12-2-safari-motion-...
- blattimwind 7y ago
  > I wonder if any other data sources exist which don’t require user permission. There really should not. Apple should know better than this and give these sensors the same permission requirements as direct GPS location, i.e. per app / per website.
dividuum 7y ago
Dust or other scratches on taken pictures can be a side channel. See the previous discussion: https://news.ycombinator.com/item?id=18835377 https://news.ycombinator.com/item?id=18835377

by zaroth 7y ago

maddyboo 7y ago

The distinction with accelerometer data is that some platforms do not require the user to grant permission to access, as opposed to camera/microphone access. Apparently, prior to iOS 12.2, Apple did not require the user to grant a website permission to access motion & orientation sensor data [1]. They have since introduced an off-by-default toggle to globally enable access to this sensor data. Unfortunately, it seems to be all-or-nothing - if you want to allow any site access to this data, you need to allow every site access to this data. Hopefully this is a temporary band-aid fix and Apple will introduce per-site permission a la camera/microphone/location permission prompts. I wonder if any other data sources exist which don’t require user permission. [1] https://www.macrumors.com/2019/02/04/ios-12-2-safari-motion-orientation-access-toggle/ https://www.macrumors.com/2019/02/04/ios-12-2-safari-motion-...

blattimwind 7y ago
> I wonder if any other data sources exist which don’t require user permission. There really should not. Apple should know better than this and give these sensors the same permission requirements as direct GPS location, i.e. per app / per website.

dividuum 7y ago

Dust or other scratches on taken pictures can be a side channel. See the previous discussion: https://news.ycombinator.com/item?id=18835377 https://news.ycombinator.com/item?id=18835377