But security experts from Princeton University found that the Battery Status API was being used by trackers as a “fingerprinting vector” – essentially, the researchers found tracking scripts that used the API to “fingerprint” devices, thereby gaining the ability to track that device’s web habits.
Advertisement
Meant to allow site owners to serve low-power versions of sites and web apps to users with little battery capacity left, soon after it was introduced, privacy researchers pointed out that it could also be used to spy on users. It was created to let developers offer a scaled-down version of their websites to devices with a low battery.
Olejnik called for new regulations that would allow users to make sites ask permission before they see the battery information, as well as suggesting that more information should be given to users about how the battery status software is used.
The Battery Status API is part of the HTML5 standard, and can be found in modern browsers like Google Chrome, Opera, and Mozilla Firefox.
Back then, the authors of the standard didn’t consider it posed a fingerprinting risk, but as The Guardian points out, these combined and highly-detailed readings can provide a pseudo-unique identifier for each device.
Well, a year has gone by and two researchers from Princeton University, Steven Englehardt and Arvind Narayanan, have published evidence of tracking in the wild. Earlier this year they found the AudioContext API was also being used to identify audio signals to fingerprint users.
The study goes on to state that, “Third parties can obtain users’ browsing histories through a combination of cookies and other tracking technologies that allow them to uniquely identify users, and the “referer” header that tells the third party which first-party site the user is now visiting”. The second retrieves the current charging status, the charge level, and the time remaining to discharge or recharge. The study also notes that battery status tracking isn’t just hypothetically possible – it’s already happening.
Uber said at the time that it does not do that, however.
“As a response, some browser vendors are considering restricting or removing access to battery readout mechanisms”, noted Olejnik. Lukasz was one of the researchers who raised concerns about the smartphone battery status API in 2015.
Advertisement
“Unfortunately, it is no surprise that battery levels are being used to track individuals”, Dr Richard Tynan from Privacy International, told The Mirror.
