Hacker News Reader

Comment by geophph | Hacker News Reader

> strava.com : Login works now that Navigator.getBattery throws the spec-mandated error type instead of one of our own (#8770).

what’s Strava want with my battery level?

View on HN

Most likely for generating unique fingerprint for tracking

Maybe it uses some that battery API as a heuristic for a lower-power version of the site? Or maybe they have a web-only version in developing markets? Low battery means it should query for your location less often to save battery?

Totally spitballing here. Strava being a website that requests battery does not seem wildly outlandish to me, albeit it is a bit suspicious in general.

> it uses some that battery API as a heuristic for a lower-power version of the site?

As a naive user I would expect websites to not be able to receive information about my battery state. With that information they can track my mobile phone usage pattern, and with some cross-referencing gain even more specific private information.

I think it is great that the API exists, but it is not great, that no permission from the user is needed to access it.

Strava's a route tracker. Assuming you can use it through the website, it probably controls how often it polls location, trading off accuracy for power consumption.

Bots trying to brute force accounts may not have the API implemented like a real device may.

Sure, and my desktop computer just reports 100% battery level? Which can't be easily replicated by a static header in the bot?

This would be a silly thing to use to identify bots.

It's not silly if it works.

Reply on news.ycombinator.com