{"id":47977,"date":"2022-08-13T00:24:19","date_gmt":"2022-08-13T00:24:19","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/let-there-be-ambient-light-sensing-without-fear-of-data-theft\/"},"modified":"2022-08-13T00:24:19","modified_gmt":"2022-08-13T00:24:19","slug":"let-there-be-ambient-light-sensing-without-fear-of-data-theft","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/let-there-be-ambient-light-sensing-without-fear-of-data-theft\/","title":{"rendered":"Let there be ambient light sensing, without fear of data theft"},"content":{"rendered":"

Six years after web security and privacy concerns surfaced about ambient light sensors in mobile phones and notebooks, browser boffins have finally implemented defenses.<\/p>\n

The W3C, everyone’s favorite web standards body, began formulating an Ambient Light Events API specification back in 2012 to define how web browsers should handle data and events from ambient light sensors (ALS). Section 4 of the draft spec, “Security and privacy considerations<\/a>,” was blank. It was a more carefree time.<\/p>\n

Come 2015, the spec evolved<\/a> to include acknowledgement of the possibility that ALS might allow data correlation and device fingerprinting, to the detriment of people’s privacy. And it suggested that browser makers might consider event rate limiting as a potential mitigation.<\/p>\n