Live data from Hacker News

Malicious Use of the HTML5 Vibrate API

shkspr.mobi

61–67 of 67 posts

Re: Malicious Use of the HTML5 Vibrate API

#61
(I designed and implemented the vibration API in Firefox.)

FWIW I liked this article. But one thing to note is that -- at least in Firefox/Firefox OS -- a page/app can only vibrate the phone if it's "visible". In the browser, a page is visible if it's in the topmost tab, if the browser app is the currently-focused app, and if the screen is not locked/off.

At least, that's how it's supposed to work. :)

Re: Malicious Use of the HTML5 Vibrate API

#62

Earlier quoted context omitted.

It's called "Vem ringde" ("Who called" in swedish). I believe the iOS does not grant enough permissions during an incoming call so when using the app on an iPhone one can only do the lookup after the call has finished (answered or missed) which explains the name (past tense). This is of course inferior to the Android functionality, but this might have changed since last time I checked.

iOS version: https://itunes.apple.com/us/app/cia/id580455042?mt=8

Thanks cangelis! It's not really clear (or I'm a lousy reader) wether it displays the information while the call is incoming or only when you've picked up (or missed) the call. If it's the former, I'm glad to hear that it's possible for iOS too!

Re: Malicious Use of the HTML5 Vibrate API

#63
> It is not impossible to conceive of malicious code being able to exploit an unpatched browser flaw and overdrive the motor to destruction.

The vibrator motors used in phones are not that fragile and vibrate being stuck on will more likely just annoy you and drain the battery faster than usual -- that is, until you get annoyed enough to pull it out.

(Maybe annoy you, as a quick search shows plenty of people who want their phone to vibrate continuously... for whatever reason.)

Re: Malicious Use of the HTML5 Vibrate API

#64
post #4

It is not impossible to conceive of malicious code being able to exploit an unpatched browser flaw and overdrive the motor to destruction. Uhm, if your argument against a HTML5 API is "it's possible that the browser is hackable" then I don't see the discussion going very far. Like, you can use the same argument against HTTP support. Combine it with a WebRTC call and you're looking at a very convincing scam. WebRTC do…

My mayor concern was: > Autoplaying sound on adverts in annoying - auto-vibration could be just as irritating. Sound can be mutated. I don’t know how difficult could be to turn off the vibration.

Hopefully a Chrome-like "prevent this page affecting vibration" dialog.

Re: Malicious Use of the HTML5 Vibrate API

#65
post #60
post #9

Earlier quoted context omitted.

What about ads? The ones that now e.g. pretend to be Skype pop-ups.

HTML Popups have always been a problem and with re targeting the Ads are a menace. And some clever spoofing is definitely possible. A proper ad/popup blocker for native browsers would help.

I sometimes wonder why AdBlock doesn't silently simulate click on all ads in the background. This way you not only protect users from ad bloat, you also make an incentive for people to stop doing website ads.

Re: Malicious Use of the HTML5 Vibrate API

#66
post #41
post #38

Earlier quoted context omitted.

As a side note to web developers dealing with audio: MP3 is really the "plays everywhere" audio format for HTML5 audio. Firefox was the last holdout, and they capitulated last year [1]; FF for XP and up and FF for Mac now support MP3. There are very few practical reasons not to use MP3. [1]: http://stackoverflow.com/questions/4923136/why-doesnt-firefo...

You'll block out some Linux users who don't want to violate patents, though. And as the other branch of this discussion painfully illustrates, Windows Mobile.

Yeah, it is not possible to please every person.

MP3 has native HTML5 audio support on web browsers (Chrome, FF, IE, Safari) for Windows XP and up, modern Macs, and any modern Droid, iOS, or Windows Phone sold in the last 5 years.

It makes MP3 the broadest supported format out there.

Re: Malicious Use of the HTML5 Vibrate API

#67
post #37
post #33

Windows Phone, once again safe from the dangers of the Internet standards and features!

Hahah. I just tested this on my Windows Phone, Nokia 925, and yeah, not only does it not vibrate, but it doesn't play the audio. The audio was a surprise, since it runs my HTML5 radio software just fine. I'm guessing the demo used OGG or some other audio format not supported by mobile IE.

Strange, because I am able to play native HTML5 MP3 audio on other sites just fine.
Post reply on HN