Phone Security

Phone Batteries Can Be Used to Spy on Their Owners and Track Them Around the Internet

Andrew Giffin | August 3, 2015

Phone batteries are sending out information that could be used to identify their owners and track them around the internet, even if they have taken very careful privacy precautions, according to a paper by security researchers.
A piece of software in HTML5 — the technology used to let people read sites on the web — tells websites how much batteryis left in a users’ phone, and is intended to allow websites to help preserve battery if phones are running low. But that same information can be used to identify phones as they move around the internet, allowing people to be tracked.

<more at http://www.independent.co.uk/life-style/gadgets-and-tech/news/phone-batteries-can-be-used-to-spy-on-their-owners-could-track-people-around-the-internet-10435578.html; related links: http://it.slashdot.org/story/15/08/03/1728255/privacy-alert-your-laptop-or-phone-battery-could-track-you-online (Privacy Alert: Your Laptop Or Phone Battery Could Track You Online. August 3, 2015) and http://betanews.com/2015/08/03/privacy-alert-your-laptop-or-phone-battery-could-track-you-online/ (Privacy alert: your laptop or phone battery could track you online. August 3, 2015); further: https://eprint.iacr.org/2015/616.pdf (The leaking battery; A privacy analysis of the HTML5 Battery Status API.  Lukasz Olejnik, Gunes Acar, Claude Castelluccia, and Claudia Diaz. [Abstract: We highlight the privacy risks associated with the HTML5 Battery Status API. We put special focus on its implementation in the Firefox browser. Our study shows that websites can discover the capacity of users’ batteries by exploiting the high precision readouts provided by Firefox on Linux. The capacity of the battery, as well as its level, expose a fingerprintable surface that can be used to track web users in short time intervals. Our analysis shows that the risk is much higher for old or used batteries with reduced capacities, as the battery capacity may potentially serve as a tracking identifier. The fingerprintable surface of the API could be drastically reduced without any loss in the API’s functionality by reducing the precision of the readings. We propose minor modifications to Battery Status API and its implementation in the Firefox browser to address the privacy issues presented in the study. Our bug report for Firefox was accepted and a fix is deployed.])>