12 ms·
Firefox Android: Camera remains active even when the phone is locked
- techntoke 6y agoIt is only a year old. I mean how high of a priority can it be to not send your camera when your phone is locked or when you send the app to the background?
- ed25519FUUU 6y agoFurthermore, how does the OS even make this possible?
- deleted 6y ago[deleted]
- techntoke 6y agoWell for music, people may want to continue listening to music when their phones are off or the app is in the background. For video I agree it doesn't make much sense, but in a web app world if you're recording video you may want to turn off the screen or do other things just like a computer. It should at least show you in the notification area.
- disiplus 6y agoi can think a scenario where the phone is acting as a sort of security camera. or you are using it as a replacement for web cam when you stream from your pc. etc. but i agree most of those are edge cases.
- TeMPOraL 6y agoIt's not as much of an edge case; spare (particularly, old) phones and tablets are used as DIY home security systems, baby monitors, etc.
- AnthonyMouse 6y agoAnd even edge cases should be supported. Maybe the default in Firefox should be to disable the camera when you lock your phone, but then it should have a setting to do otherwise, and it certainly shouldn't be rendered impossible by the OS (rather than, say, having a separate permission).
- jhoechtl 6y agoHeck even for video. Google is hammering youtube pro down my throat for the benefit of continuing pkaying while backgrounded
- kllrnohj 6y agoAccidentally bumping the power button shouldn't kill a video I'm taking or a video conference I'm in. The OS should block new uses of the camera if it's locked (sort of - face unlock obviously needs an exception), but killing existing ones seems rather aggressive and would create a new form of user hostility in relatively common situations.
- morsch 6y ago> to the background I absolutely want the Jitsi call to continue in the background while I quickly look up something in the calendar.
- GekkePrutser 6y agoTrue but there's an app for that (that probably works better than doing it in the browser, otherwise why did they make it?): https://play.google.com/store/apps/details?id=org.jitsi.meet&hl=en https://play.google.com/store/apps/details?id=org.jitsi.meet... Though I have to admit I didn't try. I've only used it on the PC and Mac. I love Jitsi though, for some reason it's sooo much smoother video than MS Teams. Really adds a lot to the communication. I wish I could use it for work, but there it's Microsoft or nothing :P
- dvno42 6y agoOnly somewhat related but I have a phone where the front camera mechanically pops up when it's used. I've noticed that by default, when I visit many websites, without notification the camera pops up and down quickly. After every Firefox update, I have to go into android settings and deny camera permissions. I've just assumed a page attempts to access the camera via JS but I'm not sure, it could also just be a bug in FF.
- smnrchrds 6y agoWhat phone do you use?
- monocasa 6y agoI think a bunch of websites try to access the camera's metadata as a part of a fingerprinting mechanism. That's probably what you're seeing.
- amoshi 6y agoI thought so too, Xiaomi Mi 9T here with a popup camera mechanism. But then again, wouldn't the website have to ask for camera permissions? Or is there some permission-less approach like the one for evaluating MIDI devices which is used for fingerprinting?
- kbrosnan 6y agoYes this is ad network fingerpriting using navigator.mediaDevices.enumerateDevices(). [1] When called without permission it would return something like > videoinput: id = csO9c0YpAf274OuCPUA53CNE0YHlIr2yXCi+SqfBZZ8= > audioinput: id = RKxXByjnabbADGQNNZqLVLdmXlS0YkETYCIbg+XxnvM= > audioinput: id = r2/xw1xUPIyZunfV1lGrKOma5wTOvCkWfZ368XCndm0= and if the user has allowed access to the camera/mic > videoinput: FaceTime HD Camera (Built-in) id=csO9c0YpAf274OuCPUA53CNE0YHlIr2yXCi+SqfBZZ8= > audioinput: default (Built-in Microphone) id=RKxXByjnabbADGQNNZqLVLdmXlS0YkETYCIbg+XxnvM= > audioinput: Built-in Microphone id=r2/xw1xUPIyZunfV1lGrKOma5wTOvCkWfZ368XCndm0= [1] https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/enumerateDevices https://developer.mozilla.org/en-US/docs/Web/API/MediaDevice...
- devit 6y agoSeems not a bug: you may want this behavior, and the proper way to stop recording is to close the website or the app, not locking your phone.
- noja 6y agoSure some may want this behavior, but I think most will not: it's unexpected.
- kbenson 6y agoI think it's probably more complex than that. It's either unexpected or expected depending on what you're trying to do, as shown by the cases mentioned here in the comments. You want to record something but you want your phone in your pocket (and locked, so you don't accidentally touch something). You want to use it as a baby monitor for a room. Your in a conference meeting call but in your car without a charger, so would prefer to not waste battery on the screen. Those are all cases where if you were were actively using the camera and locked the phone, you might reasonably expect the camera to continue working as it seems a use case people would have. At the same time, there's the desire to know that when your phone is not in active use (i.e. locked) it's not recording you. I think this is a textbook case of where our expectations are contextual, and conflicting. A naive adherence to one expectation or the other will leave people unhappy. Perhaps then, a less naive behavior (prompting on lock, a visual indicator of any recording, etc) is sufficient.
- kbrosnan 6y agoThere is a visual indicator Firefox provides an Android notification that appears when the camera and/or the mic is in use.
- kbenson 6y agoBy visual indicator, I specifically mean a visual indicator that showed when your phone is locked, and the screen may be off (like an LED, as iOS is apparently enabling). To be clear, that's not only not an app's responsibility, and in fact it should not be something an app can change at all, so I don't really think Firefox should worry about changing how it indicates this. Because part of this has to do with security/privacy and at the device level, this is really something Android needs to tackle. None of the solutions I proposed are really appropriate for an application, since that would imply an application has control over them, and they are useful only if an application can't change them so you can have assurance they work as expected. This is less an issue of trusting Firefox, which I do (for the most part, but it does have a large security surface to be aware of since it runs remote code), and more an issue of trusting something like Zoom or Tik Tok, which I don't really.
- mcbits 6y agoThis could be desirable behavior in some circumstances, e.g. recording video where someone might seize the device and try to stop the recording, or snoop through the device while it's unlocked.
- akerro 6y agoThis! I once was in a car accident and wanted to record the conversation, I started recording, locked phone and put it into my pocket. camera app stopped recording when screen was locked, edge case but really unexpected one for me. Web browser shouldn't be doing it tho.
- mcbits 6y agoIf a site is granted access to the camera, and the OS lets other camera apps continue while locked, it makes sense for the browser to at least provide the option of keeping the camera on while locked. Otherwise it just hinders sites from providing live streaming/backup services entirely through the browser without installing yet another app.
- ggreer 6y agoWow, I didn't know this. I just tried with iOS 14 beta and was surprised to see video/audio recording stop as soon as I hit the button to lock the screen. By the way: You might want to try recording something while walking around with your phone in your pocket. My guess is that your clothing will muffle sound. Any movement will cause fabric to rub against the phone, drowning out the sound you actually want to record. Even if your tactic did work, I'm not sure it would have captured much of the conversation.
- akerro 6y ago>By the way: You might want to try recording something while walking around with your phone in your pocket. My guess is that your clothing will muffle sound. Many android phones detect being in pocket and lock screen automatically to prevent accidental touches.
- kbrosnan 6y agoFor a user to be affected by this they woul need to: * They would need to visit a website using webrtc * Grant Firefox the Android camera/microphone permissions * They would then be prompted to allow the website access to the camera and microphone * For this to be a persistent problem the user would need to check a box that says "Remember my decision for this site" this is unchecked by default in the above dialog As comments here and in the bug there are cases where leaving the camera active is useful so this is not as cut and dry as the title leads you to believe.
- deleted 6y ago[deleted]
- pgo 6y agoSorry but you make it sound like its four independent actions which lowers the overall probability. While in reality this whole sequence of actions is a very common thing for a user to do.
- kbenson 6y ago> you make it sound like ... lowers the overall probability I think that depends on whether you interpret the comment as trying to mitigate the perceived magnitude of the issue, or provide clear and concise information on what the issue entails. I read it more as a "here's what the preconditions are, and there's some question as to whether the issue is actually a bug or not", and not "you have to do this for it to be a problem, so it's less bad than you think", so the wording didn't seem problematic at all to me.
- hn_throwaway_99 6y agoFWIW based on how it was written I interpreted it as the latter "you have to do this for it to be a problem, so it's less bad than you think", so glad you clarified that wasn't your intent.
- kbenson 6y ago
- duxup 6y agoI wish there was a hardwired led indicator, one for mic and one for camera. When not in use neither the mic nor the camera would get power and the leds tied to the same power connection. If they're on, you know they're on. Yeah for "ok google" or whatever service it would be on all the time, but you'd know. A physical switch to cut power would be nice too. I know there are likely some software complications such as checking 'hey does the camera work / is it there' but maybe that's more of a symptom of a problem.
- GekkePrutser 6y agoApple is doing this now in iOS 14 - not quite hardwired but their OS is so controlled it's nearly the same thing. I doubt an app can bypass it. https://9to5mac.com/2020/07/07/ios-14-what-do-the-orange-and-green-dots-in-the-status-bar-mean/ https://9to5mac.com/2020/07/07/ios-14-what-do-the-orange-and... On Android you have the pop-up phones of course! Sadly they are super heavy... I was checking the Poco F2 last weekend and it's > 200 grams which is really a lot. Great for privacy though (and I really don't care about the front cam much anyway).
- katbyte 6y agoWow that’s awesome, I have an app installed on my MacBook that pops up something when the mic is in use and it’s a great addition.
- GekkePrutser 6y agoEdit: Oops you were talking about the mic, not the cam.. So the green light I spoke of doesn't apply. I wouldn't be surprised if this feature came to Big Sur too though! But the current beta doesn't have it.
- efreak 6y agoA microphone is a passive component, it doesn't need power. If you plug it into your headphones jack, it turns into a speaker. The indicator you want would be controlled by firmware or operating system, or by a physical switch, not by a common path to the microphone.
- coronadisaster 6y agowow that is really bad, I am increasingly loosing fate in Firefox and I have been using it since v1.0
- GekkePrutser 6y agoI'm sure this wasn't intentional though. It doesn't even benefit them in any way. It's not as if they were doing it to steal information. It's just a bug, at least it's known now and they'll fix it.
- coronadisaster 6y agoassuming the NSA isn't behind it and cutting them a check
- jacquesm 6y agoThat's well into tinfoil hat territory unless you have some proof of this.
- coronadisaster 6y agovery true, but is there even a way to even know how much money they get from the government? (With this black budget bullshit... Who introduced that concept anyways)
- swebs 6y agoNot Mozilla, but there's plenty of proof for other big tech companies, including Google. https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program)
- jacquesm 6y agoBut this is about Mozilla, which is not all like the other big tech companies. They've definitely made some mistakes but I'd pause for a long time before accusing them of malice at that level.
- badrabbit 6y agoOk, but why is this up to the browser? If it was any other app, how can users be protected? Shouldn't this be enforced by the hardware ideally?
- kerng 6y agoInteresting, but why is this possible in the first place on Android?
- ars 6y agoBecause I might still want to record things with my screen off? Imagine you are recording a video, and you turn of the screen to save power - why would you expect it to stop recording?
- LockAndLol 6y agoThis could (maybe even should) be handled by Android permissions itself e.g allow app to be access camera when screen is off or locked. But this has been inactive mostly inactive for a year, which shows where priorities lie.
- pmlnr 6y agoPlease keep this as an _option_. The current lack of having background video streaming prevents me from using my old androids as dashboard AND a network camera, even though they have the capacity to be both.
- sakis 6y agoRelevant/obligatory xkcd: https://xkcd.com/1172/ https://xkcd.com/1172/ On the subject, I would really prefer this to be an option as well, even with the default being not the current default, however I see that there is a general trend of removing a lot of fine tuning knobs in apps (android or otherwise) in the sake of reducing complexity for the end-user.
- httpsterio 6y agoDoesn't Android require the camera permissions in order to use the microphone? I mean, it makes sense to keep a webrtc connection alive even if you lock the screen (if you're on a voip ball for example)
- asveikau 6y agoI don't see why microphone should require camera access. I can think of a few scenarios that need the former and not the latter. What about a voice calling app that doesn't have video calling support? What about a sound recorder, voice recorder, music capture or PTT/walkie-talkie app? What about something like Shazam?
- dec0dedab0de 6y agoMeh.. If I was in a video chat and my phone locked i wouldnt want it to get discconected
- blendergeek 6y agoThis is the behavior I expect and desire from my phone. Locking the screen should not suddenly end my video call. To end my video call, I should press the 'end call' button. I can think of scenarios where I would want my phone to record without showing any notice at all (some people have mentioned law enforcement interactions, I think this is a good example of such a situation).
- teekert 6y agoSince Covid19 I've been using Jitsi a lot. I gave the same "chatroom" to my parents and parents in law, as a way to speak to the kids. Then at some point I'm getting a message from my father saying they can hear my parents in law speak from their living room in our Jitsi room. It turns out the app does not hang up when moving to another app. So they probably spend a couple of days streaming... No idea if others visited the room, it has a rather unique but not very long name and no password... I know one should hang up, but, keeping a video+audio stream alive in the background should also lead to some warning imho. Btw, this was the iPad Jitsi app keeping the connection alive, not the website.
- raziel2p 6y agoThe app could probably benefit from a "are you still there?" type message when the app has been in the background for an hour. Alternatively, there should be a way to "host" a meeting, similar to in Zoom, which gives you the option to end the meeting for everyone.
- tikkabhuna 6y agoPretty sure all video apps on iOS do this? Normally the status bar changes to put a coloured pill around the time. WhatsApp, FaceTime, and Zoom do this but they will pause video while in the background. Personally I would be annoyed if calls were killed while swapping to other apps.
- teekert 6y agoTrue, it's nice that it can continue. A warning after some time would be nice though.
- jka 6y agoThat's a reasonable concern - I'd recommend searching for existing threads at https://github.com/jitsi/jitsi-meet/issues https://github.com/jitsi/jitsi-meet/issues related to 'iOS' 'background' and any other terms, and raising an issue if none exists. The Jitsi team is pretty responsive on GitHub, and this sounds like the kind of issue that might be a good self-contained task for someone to work on.
- srg0 6y ago/Offtopic I remember that at some point it was possible to open a Youtube video in Firefox for Android, lock the screen, and it kept on playing. It was great for some podcast-like / talking channels. Then either Firefox changed or Youtube cracked down on this.
- jeroenhd 6y agoAs far as I know, Firefox still allows you to play video in the background from the lock screen. It's probably YouTube that changed (because they want you to pay them for the feature, because people use YouTube for background music). You can keep it from pausing by requesting the desktop site in Firefox. The mobile site pauses, the desktop site just keeps playing.
- srg0 6y agoInteresting. I tried it in Firefox for Android, and the desktop site plays for a couple of seconds after screen lock and then stops. It might depend on the video.
- jeroenhd 6y agoIt probably also depends on the power saving settings your phone enforces. From what I've seen from DontKillMyApp[0] the optimalizations vary widely per manufacturer and probably per device and ROM as well. I don't think the websites cares much, at least it didn't for me and I tested it with a music video (something Youtube usually doesn't like you playing in the background without a subscription). Your phone's settings and optimizations are a more likely culprit, in my opinion. [0]: https://dontkillmyapp.com/ https://dontkillmyapp.com/
- ohgodplsno 6y agoIt used to work if you were using m.youtube.com. not anymore, sadly. However, NewPipe allows you to do the same thing and is available on f-droid
- cookiengineer 6y agoAlso, Firefox for Android has Google AdMob integration and uses firebase as a hosting service for some scripts. I lately started to use Appwarden [1] to check some apps, and I'm amazed how messed up the App ecosystem is in terms of advertising trackers and abusive CDNs - even if you use only AOSP builds, no gapps, and only f-droid, you can get compromised very easily. [1] https://gitlab.com/AuroraOSS/AppWarden https://gitlab.com/AuroraOSS/AppWarden
- jbaber 6y agoThis is why I still use [bouncer] despite the fact that it's roughly been replaced by Android's new only-while-app-is-running style permission. I have great* confidence the camera is off when, after hitting the home key, I actually see the permissions for the app switch off. [bouncer]: https://play.google.com/store/apps/details?id=com.samruston.permission&hl=en_US https://play.google.com/store/apps/details?id=com.samruston....