diff --git a/index.bs b/index.bs index 43ed0da..d8a5009 100644 --- a/index.bs +++ b/index.bs @@ -33,6 +33,9 @@ urlPrefix: https://w3c.github.io/sensors; spec: GENERIC-SENSOR text: reporting mode; url: reporting-modes text: auto text: construct a sensor object; url: construct-sensor-object + text: limit maximum sampling frequency; url: limit-max-frequency + text: reduce accuracy; url: reduce-accuracy + text: mitigation strategies; url: mitigation-strategies Introduction {#intro} @@ -71,8 +74,32 @@ Examples {#examples} Security and Privacy Considerations {#security-and-privacy} =================================== -There are no specific security and privacy considerations -beyond those described in the Generic Sensor API [[!GENERIC-SENSOR]]. +Ambient Light Sensor provides information about lighting conditions near +the device environment. Potential privacy risks include: + + - Information leaks about the user’s surrounding and work habits. + - Profiling. Readout from Ambient Light Sensor can potentially induce + information leaks about the user’s interests, web use and work + habits, as well as the users’ surrounding. This information might be used + to enhance the user profiling and behavioral analysis. + - Cross-device linking and tracking. Access to sufficiently precise readouts + of Ambient Light Sensor potentially enhance cross-device linking + techniques. Such situation may arise if two different devices access web + sites including same third-party scripts that compare lighting levels over + time. + - Cross-device communication. Verbose readout of Ambient Light Sensor could + be applied to receive messages emitted by other devices in nearby + location. A simple messaging method could arise by multiple devices + flashing their screens or camera LEDs and reading out responses with + Ambient Light Sensors. + +To mitigate these Ambient Light Sensor specific threats, user agents should +use the following mitigation strategies: + - limit maximum sampling frequency, and + - reduce accuracy of sensor readings. + +The generic mitigation strategies are described in the Generic Sensor +API [[!GENERIC-SENSOR]]. Model {#model} ===== @@ -141,6 +168,8 @@ Paul Bakaus for the LightLevelSensor idea. Mikhail Pozdnyakov and Alexander Shalamov for the use cases and requirements. +Lukasz Olejnik for the privacy risk assessment. + Conformance {#conformance} =========== diff --git a/index.html b/index.html index 731f606..c19a4d5 100644 --- a/index.html +++ b/index.html @@ -1549,8 +1549,39 @@

2.

3. Security and Privacy Considerations

-

There are no specific security and privacy considerations -beyond those described in the Generic Sensor API [GENERIC-SENSOR].

+

Ambient Light Sensor provides information about lighting conditions near +the device environment. Potential privacy risks include:

+ +

To mitigate these Ambient Light Sensor specific threats, user agents should +use the following mitigation strategies:

+ +

The generic mitigation strategies are described in the Generic Sensor +API [GENERIC-SENSOR].

4. Model

The Ambient Light Sensor’s associated Sensor subclass is the AmbientLightSensor class.

@@ -1595,6 +1626,7 @@

8. Conformance

Conformance requirements are expressed with a combination of descriptive assertions and RFC 2119 terminology. The key words "MUST", @@ -1638,6 +1670,9 @@

default sensor
  • high-level
  • implementation specific +
  • limit maximum sampling frequency +
  • mitigation strategies +
  • reduce accuracy
  • reporting mode