A SMALL FEATURE ASSOCIATED with HTML5, which is used to structure and present pages on the web, could be used to track a person online, security researchers have warned.
The HTML5 standard, Battery Status API, allows a site to ask for a device’s battery level or charging status. The reason was so developers could offer a low-power version – turning off power-intensive features – to help preserve a device’s battery life.
Last year, researchers found that this information could be used to identify devices and track them as they visit different sites. As the API offers data about a device’s battery in both percentages and time left in seconds, sites and adverts can identify a device, even it was using privacy methods.
So if a user visits a site normally, but decided to visit a different site in private browsing mode, an advert or script on both pages would be able to tell that both visits came from the same device.
And recently, two researchers from Princeton University proved that tracking scripts were reading battery levels for this purpose.
By running a specifically modified browser, Steve Engelhard and Arvind Narayanan found two tracking scripts that used the Battery Saver API to “fingerprint” a specific device, allowing them to identify it across different visits.
One of the authors of last year’s report, Lukasz Olejnik, said that while some browser makers are considering restricting or removing access to this, he warned that some companies or bad actors could be thinking of using it to their advantage.
“Additionally, some companies may be analysing the possibility of monetising the access to battery levels,”he wrote. “When battery is running low, people might be prone to some – otherwise different – decisions. In such circumstances, users may agree to pay more for a service.”
To embed this post, copy the code below on your site
have your say