Security and Privacy considerations for ALS · Issue #13 · w3c/ambient-light (original) (raw)

Skip to content

Navigation Menu

• • GitHub Copilot Write better code with AI
  • GitHub Advanced Security Find and fix vulnerabilities
  • Actions Automate any workflow
  • Codespaces Instant dev environments
  • Issues Plan and track work
  • Code Review Manage code changes
  • Discussions Collaborate outside of code
  • Code Search Find more, search less
• Explore
  • Learning Pathways
  • Events & Webinars
  • Ebooks & Whitepapers
  • Customer Stories
  • Partners
  • Executive Insights
• • GitHub Sponsors Fund open source developers
  • The ReadME Project GitHub community articles
• • Enterprise platform AI-powered developer platform
• Pricing

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sign up

Description

I would suggest updating security/privacy considerations with the following:

Ambient Light Sensor API provides information about lighting conditions near the device environment. There are several potential privacy risks related with exposing this information on the web.

• Information leaks about the user’s surrounding and work habits.
• Profiling. Readout from Ambient Light Sensor can potentially induce information leaks about the user’s interests, web use and work habits, as well as the users’ surrounding. This information might be used to enhance the user profiling and behavioral analysis.
• Cross-device linking and tracking. Access to sufficiently precise readouts of Ambient Light sensors potentially enhance cross-device linking techniques. Such situation may arise if two different devices access web sites including same third-party scripts that compare lighting levels over time.
• Cross-device communication. Verbose readout of Ambient Light Sensor could be applied to receive messages emitted by other devices in nearby location. A simple messaging method could arise by multiple devices flashing their screens or camera LEDs and reading out responses with Ambient Light Sensors

The user agent SHOULD expose minimized lighting levels.

A verbose, high-resolution readout from the API SHOULD be subject to permissions.

The user agent SHOULD inform the user about the current and past uses of the API.