Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Tuesday February 07 2017, @05:04AM   Printer-friendly
from the watching-those-who-watch-us dept.

When Google popped out Chrome 56 at the end of January it was keen to remind us it's making the web safer by flagging non-HTTPS sites. But Google made little effort to publicise another feature that's decidedly less friendly to privacy, because it lets websites connect to Bluetooth devices and harvest information from them through the browser.

[...Pete] LePage, in the video, says: "Until now, the ability to communicate with Bluetooth devices has been possible only for native apps. With Chrome 56, your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API. "The Web Bluetooth API uses the GATT protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript."

Let's start with LePage's security-and-privacy claims: what Google means is that the server-to-browser connection is over TLS, and users have to allow connection with a touch or a mouse click. To reiterate: as a user, you have to explicitly grant the remote web app access to your Bluetooth gadgets before anything happens. Then you select a device to pair with the webpage, and away you go. The webpage can filter for devices, so for example, a health site can ask to be paired with gadgets that have a heart rate sensor. A site can't see any device until it is paired.

Source:

https://www.theregister.co.uk/2017/02/05/chrome_56_quietly_added_bluetooth_snitch_api/


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by boltronics on Tuesday February 07 2017, @09:44AM

    by boltronics (580) on Tuesday February 07 2017, @09:44AM (#463959) Homepage Journal

    Funny you should mention that. I recently (as in, the last week) switched all my computers over to Pale Moon because Firefox was too laggy.

    Last week at work, I clicked the Firefox launcher icon (Firefox ESR under Debian Jessie on an i7-930 with 24Gb of RAM), waited about 5 seconds, got tired of waiting and clicked on the Pale Moon launcher icon, Pale Moon opened and I typed in the URL, the page started loading and then Firefox finally appeared. At that point, Firefox just had to go.

    Well, that and that they took out Group Tabs and said "use this extension if you want it back", and then shortly afterwards the developer of the extension said he wouldn't be maintaining it anymore due to Mozilla changing the API in a way that would basically require a complete rewrite.

    Also, Firefox Sync is no longer compatible with my ownCloud Sync server (without messing around a lot in about:config at least), whereas Pale Moon uses the better, older Sync method that continues to work just fine. Pale Moon for Android also works fine with ownCloud Sync, whereas Firefox Mobile does not, so I made the switch on my phone too.

    Oh, and Pale Moon doesn't have all of the privacy issues that I previously had to fix every time I installed it - disabling domain security checks, crash reporting, etc. And I don't need to worry about EME extensions and all that nasty DRM in my browser. I've been using Firefox since it was called Phoenix (which was before it was called Firebird). Wish I had tried switching sooner.

    --
    It's GNU/Linux dammit!
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2