Mozilla says Chrome’s latest feature enables surveillance

Post by mrsalt » Fri, Sep 24, 2021, 4:46 AM UTC

kevingadd wrote: post #99

pteraspidomorph wrote: post #84

I find the page visibility API, supported by every browser including Firefox, just as creepy. Perhaps even more, since most users don't know it exists and gave no permission for it to operate. Websites have no business knowing if I'm looking at them or not, and making assumptions about what I want them to do when I'm not. https://developer.mozilla.org/en-US/docs/Web/API/Page_Visibi...

Interestingly, this API is one of the tools Youtube uses to stop you from playing videos in the background on mobile.

Post by [deleted] » Fri, Sep 24, 2021, 5:24 AM UTC

afavour wrote: post #19

I am a privacy-conscious person but I really wish these debates could be a little more nuanced. This API is behind a permission prompt that can only be triggered in response to a user gesture, so the bar to entry is high. The example on web.dev is a chat app that would automatically set an active/away status: seems useful! IMO I ought to have the ability to cash in some of my privacy chips (so to speak) on a site tha…

Post by google234123 » Fri, Sep 24, 2021, 5:42 AM UTC

somehnacct3757 wrote: post #95

afavour wrote: post #19

I am a privacy-conscious person but I really wish these debates could be a little more nuanced. This API is behind a permission prompt that can only be triggered in response to a user gesture, so the bar to entry is high. The example on web.dev is a chat app that would automatically set an active/away status: seems useful! IMO I ought to have the ability to cash in some of my privacy chips (so to speak) on a site tha…

The privacy problem isn't that Chrome is offering this permission to websites, it's that they built it into the browser at all. Now their browser, regardless of whether you're using any websites with this permission granted or not, has code that tracks if you're idle or not. There's no bar of entry whatsoever for this. Chrome will automatically update itself to Chrome 94 and voila - it tracks your idle status. Worse…

Post by godelski » Fri, Sep 24, 2021, 5:54 AM UTC

handoflixue wrote: post #85

ipaddr wrote: post #77

Earlier quoted context omitted.

So after 20 minutes instead of logging you out the away status is set. Not sure I understand your special case here.

Can't speak for the other commenter, but I'm "available" when I sit at my computer playing Civilization for 6 hours, despite the fact that I won't touch my IM application that entire time. If you're trying to set "Away" based on how often I interact with the application, you're getting it wrong for 5 hours and 40 minutes of that period.

Post by dmitriid » Fri, Sep 24, 2021, 6:22 AM UTC

afavour wrote: post #51

dmitriid wrote: post #50

Earlier quoted context omitted.

> This API is behind a permission prompt that can only be triggered in response to a user gesture, so the bar to entry is high. It really isn't. Some time look at the permissions controls in Chrome. https://twitter.com/dmitriid/status/1434086651362430976?s=20 Most of these toggles will pop up a permissions dialog. Trigger enough of those, and the user will either dismiss them automatically or accept automatically.

I don't understand what you're saying. It absolutely is behind a permission prompt. If you go to the demo site: https://idle-detection.glitch.me/ and click "ephemeral", it shows a prompt next to the address bar saying "idle-detection.glitch.me wants to know when you're actively using this device" and has buttons for "block" and "allow". So I don't know how "it really isn't" could be true in this case.