3 ms·

At what point on the line does tracking people based on side effects of running JS become illegal unauthorized access to a computer. For example if there is an

by mc3 7y ago

At what point on the line does tracking people based on side effects of running JS become illegal unauthorized access to a computer. For example if there is an exploit to read your local files and upload them to the server, that would clearly be illegal. What if you just got the names of the files? What if you just got the count, e.g. 33413 and stored it against a name? What about the count, but just used as a semi-anonymous tracking token? What about system information, as a tracking token? What about audio information specifically, as a tracking system? (Like this appears to be. Didn't read the article because it won't load for me).

thenewnewguy 7y ago
I don't know how well this would stand up in court, but the obvious difference here seems to be using "an exploit to read your local files" vs an intentionally designed API.
- TeMPOraL 7y ago
  Unless it's flipping bits via radiation, every exploit is (ab)using "an intentionally designed API". In this case, audio API may be intentionally designed, but the intention wasn't to allow fingerprinting.
  - air7 7y ago
    True, but there's still a difference between abuse via a buffer overflow "mistake" and say the overly verbose Battery Status API.
    - liability 7y ago
      A technical difference, sure. A legal difference? I don't know. A moral difference? Absolutely not.
- _ink_ 7y ago
  Neither the canvas API, nor the audio API was designed with the idea of providing funtionalities for user tracking. To me it is a clear misuse and I find the comparision to an exploit fair. I really would like to see somebody sue.