91–100 of 122 posts
Couldn't this information already be discerned fairly easily by user interaction such as mouse movements, requests or scrolling?
Earlier quoted context omitted.
my point, that you glossed over, can be illustrated this way: I want my phone to have GPS so I can use it to figure out where I am, for mapping, etc. I don't want it used for spying on me. An opt-in system to allow GPS (or idle detection) is an explicit control, but it is not toggling the usage of this low level feature, which is the important part that I want to approve. Approvals should not be blanket.
It's a per-website toggle, how much more granularly approved do you need it to be?
Earlier quoted context omitted.
It's a per-website toggle, how much more granularly approved do you need it to be?
usage, not vendor
I am a privacy-conscious person but I really wish these debates could be a little more nuanced. This API is behind a permission prompt that can only be triggered in response to a user gesture, so the bar to entry is high. The example on web.dev is a chat app that would automatically set an active/away status: seems useful! IMO I ought to have the ability to cash in some of my privacy chips (so to speak) on a site tha…
There's no bar of entry whatsoever for this. Chrome will automatically update itself to Chrome 94 and voila - it tracks your idle status. Worse yet is if you try to complain, they can shift the conversation by saying the ability is there for websites behind a permission dialog, and of course they take user privacy seriously. Basically exactly what you've done!
I don't think it's paranoid to assume nefarious intent because web devs weren't asking for this functionality nor was it impossible before. You add a mouse listener to the page, you check document.hidden, etc. With so many techniques already available ask yourself: why did Google spend time building this? And why didn't they consult other web stakeholders?
Imagine if Mozilla spent even one tenth the amount of effort on their own crappy product as they do hand-wringing about Chrome. We might have another viable web browser.
I am a privacy-conscious person but I really wish these debates could be a little more nuanced. This API is behind a permission prompt that can only be triggered in response to a user gesture, so the bar to entry is high. The example on web.dev is a chat app that would automatically set an active/away status: seems useful! IMO I ought to have the ability to cash in some of my privacy chips (so to speak) on a site tha…
The privacy problem isn't that Chrome is offering this permission to websites, it's that they built it into the browser at all. Now their browser, regardless of whether you're using any websites with this permission granted or not, has code that tracks if you're idle or not. There's no bar of entry whatsoever for this. Chrome will automatically update itself to Chrome 94 and voila - it tracks your idle status. Worse…
I find the page visibility API, supported by every browser including Firefox, just as creepy. Perhaps even more, since most users don't know it exists and gave no permission for it to operate. Websites have no business knowing if I'm looking at them or not, and making assumptions about what I want them to do when I'm not. https://developer.mozilla.org/en-US/docs/Web/API/Page_Visibi...
For reference, it requires a permission dialog and the demo is here: https://reillyeon.github.io/scraps/idle.html
Interesting that the minimum threshold is one minute. That might be too long for features like auto-saving documents, but lower-precision probably avoids a lot of nasty use cases too.