Hacker News Reader

Comment by colordrops | Hacker News Reader

Kind of disturbing that Chrome just provides gyroscope data without any notification to the user.

What would one feasibly do with this data? I guess an app could tell if someone is holding their phone in their had, and maybe put together a pedometer bases on gyroscope input. Maybe a concern if a app has access to gyro input over a period of days.

But as long as it's only for actively open apps and web pages I don't really see much harm.

The gyroscope is a datapoint that can be used for fingerprinting. Plus it gives quite a bit of information about you: whether you are lying down, sitting, walking, etc.

doesn't this assume the user is walking around with the page open, the front tab, and the phone unlocked for a reasonably long period? which websites do I spend enough time on for that to be true? I don't generally walk and read

Browsers now have service workers that run in the background even when the browser UI isn't loaded.

> I don't generally walk and read

That's how I spend 10-ish% of my time on Hacker News

With sufficiently high-frequency gyroscope data, it is possible to infer what a user types in with moderate precision. In some cases, it has even been shown to be possible to recover coarse audio data from the surrounding environment.

https://bugs.chromium.org/p/chromium/issues/detail?id=421691

Browsers have added rate limiting to mitigate this threat. (Prior to that, my former team in Google Ads added our own rate limiting to the gyroscope API we provided for ads.) The risk now seems pretty minor, but I wouldn't be shocked if someone clever still managed to find some way to abuse it.

> gyroscope API we provided for ads

Whaaaa?

Yeaaaaah. Our clients thought it was super-cool to add distracting battery-destroying parallax effects to their mobile ads. :|

What business model do you think Google has?

Eavesdrop on audio: https://www.wired.com/2014/08/gyroscope-listening-hack/

Know what you are typing: https://www.newscientist.com/article/mg21128255-200-smartpho...

Facebook has a patent for using gyroscope data in conjunction with location to know who you are facing with other people around to enhance friend suggestions.

You can also determine things like health and other physical characteristics, similar to gait detection.

...wait, how do you get orientation relative to things around you (rather than just your own previous orientation and gravity) from just gyro/accelerometer data + location?

If you do have some source of absolute orientation, like a compass, surely you just use that and don't need the gyro.

That's a good question. I suppose it may be possible to use GPS data to estimate the phone's absolute heading.

I just took a quick look at https://developer.mozilla.org/en-US/docs/Web/API/Detecting_d..., and it seems to provide orientation, and not angular velocities. So it could also be that browser implementations fuse magnetometer and inertial sensors to produce the orientation estimate. Is there another gyro API?

Maybe the compass gives you noisy absolute information which is ok, but combined with accurate relative information from the gyroscope and accelerometer is better?

How is this disturbing at all? Do you get disturbed that websites know your mouse pointer location?

If the mouse cursor is outside the browser window, sure. Gyroscope data is relatively personal and not easy to modify, so it serves as a much better tracking tool than the mouse cursor.

FWIW, Safari on iOS didn't ask me either. I'm actually kind of disappointed.

It worked just fine for me.

GP meant that Safari doesn’t ask for permission to use the accelerometer. In that sense, it can’t have worked just fine for you since Safari doesn’t have that as a privacy option.

My thought exactly. Totally surprised me. I thought the only inputs a web site could get from me from hardware without asking permission is key presses and cursor movement.

Reply on news.ycombinator.com