diff --git a/index.bs b/index.bs index 43ed0da..d8a5009 100644 --- a/index.bs +++ b/index.bs @@ -33,6 +33,9 @@ urlPrefix: https://w3c.github.io/sensors; spec: GENERIC-SENSOR text: reporting mode; url: reporting-modes text: auto text: construct a sensor object; url: construct-sensor-object + text: limit maximum sampling frequency; url: limit-max-frequency + text: reduce accuracy; url: reduce-accuracy + text: mitigation strategies; url: mitigation-strategies Introduction {#intro} @@ -71,8 +74,32 @@ Examples {#examples} Security and Privacy Considerations {#security-and-privacy} =================================== -There are no specific security and privacy considerations -beyond those described in the Generic Sensor API [[!GENERIC-SENSOR]]. +Ambient Light Sensor provides information about lighting conditions near +the device environment. Potential privacy risks include: + + - Information leaks about the user’s surrounding and work habits. + - Profiling. Readout from Ambient Light Sensor can potentially induce + information leaks about the user’s interests, web use and work + habits, as well as the users’ surrounding. This information might be used + to enhance the user profiling and behavioral analysis. + - Cross-device linking and tracking. Access to sufficiently precise readouts + of Ambient Light Sensor potentially enhance cross-device linking + techniques. Such situation may arise if two different devices access web + sites including same third-party scripts that compare lighting levels over + time. + - Cross-device communication. Verbose readout of Ambient Light Sensor could + be applied to receive messages emitted by other devices in nearby + location. A simple messaging method could arise by multiple devices + flashing their screens or camera LEDs and reading out responses with + Ambient Light Sensors. + +To mitigate these Ambient Light Sensor specific threats, user agents should +use the following mitigation strategies: + - limit maximum sampling frequency, and + - reduce accuracy of sensor readings. + +The generic mitigation strategies are described in the Generic Sensor +API [[!GENERIC-SENSOR]]. Model {#model} ===== @@ -141,6 +168,8 @@ Paul Bakaus for the LightLevelSensor idea. Mikhail Pozdnyakov and Alexander Shalamov for the use cases and requirements. +Lukasz Olejnik for the privacy risk assessment. + Conformance {#conformance} =========== diff --git a/index.html b/index.html index 731f606..c19a4d5 100644 --- a/index.html +++ b/index.html @@ -1549,8 +1549,39 @@
There are no specific security and privacy considerations -beyond those described in the Generic Sensor API [GENERIC-SENSOR].
+Ambient Light Sensor provides information about lighting conditions near +the device environment. Potential privacy risks include:
+Information leaks about the user’s surrounding and work habits.
+Profiling. Readout from Ambient Light Sensor can potentially induce +information leaks about the user’s interests, web use and work +habits, as well as the users’ surrounding. This information might be used +to enhance the user profiling and behavioral analysis.
+Cross-device linking and tracking. Access to sufficiently precise readouts +of Ambient Light Sensor potentially enhance cross-device linking +techniques. Such situation may arise if two different devices access web +sites including same third-party scripts that compare lighting levels over +time.
+Cross-device communication. Verbose readout of Ambient Light Sensor could +be applied to receive messages emitted by other devices in nearby +location. A simple messaging method could arise by multiple devices +flashing their screens or camera LEDs and reading out responses with +Ambient Light Sensors.
+To mitigate these Ambient Light Sensor specific threats, user agents should +use the following mitigation strategies:
+reduce accuracy of sensor readings.
+The generic mitigation strategies are described in the Generic Sensor +API [GENERIC-SENSOR].
The Ambient Light Sensor’s associated Sensor
subclass
is the AmbientLightSensor
class.
Conformance requirements are expressed with a combination of descriptive assertions and RFC 2119 terminology. The key words "MUST", @@ -1638,6 +1670,9 @@