The Leaking Battery - A Privacy Analysis of the HTML5 Battery Status API
The Leaking Battery - A Privacy Analysis of the HTML5 Battery Status API
复制标题
DOI：
10.1007/978-3-319-29883-2_18
复制
发表时间：
2015-09
期刊：
影响因子：
--
通讯作者：
Lukasz Olejnik;Gunes Acar;C. Castelluccia;Claudia Díaz
中科院分区：
文献类型：
--
作者：
Lukasz Olejnik;Gunes Acar;C. Castelluccia;Claudia Díaz
© Springer International Publishing Switzerland 2016.我们强调与HTML5电池状态API相关的隐私风险。我们特别关注它在Firefox浏览器中的实现。我们的研究表明，网站可以通过利用Linux上的Firefox提供的高精度读数来发现用户的电池容量。电池的容量以及它的水平，暴露出一个可指纹识别的表面，可用于在短时间内跟踪网络用户。我们的分析表明，容量减少的旧电池或二手电池的风险要高得多，因为电池容量可能会作为跟踪标识符。API的可指纹识别的表面可以通过降低读数的精度而大大减少，而不会损失API的功能。我们建议对电池状态API及其在Firefox浏览器中的实现进行微小修改，以解决研究中提出的隐私问题。我们的Firefox错误报告被接受，并部署了修复程序。
© Springer International Publishing Switzerland 2016. We highlight privacy risks associated with the HTML5 Battery Status API. We put special focus on its implementation in the Firefox browser. Our study shows that websites can discover the capacity of users’ batteries by exploiting the high precision readouts provided by Firefox on Linux. The capacity of the battery, as well as its level, expose a fingerprintable surface that can be used to track web users in short time intervals. Our analysis shows that the risk is much higher for old or used batteries with reduced capacities, as the battery capacity may potentially serve as a tracking identifier. The fingerprintable surface of the API could be drastically reduced without any loss in the API’s functionality by reducing the precision of the readings. We propose minor modifications to Battery Status API and its implementation in the Firefox browser to address the privacy issues presented in the study. Our bug report for Firefox was accepted and a fix is deployed.