Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious Use of the HTML5 Vibrate API

shkspr.mobi

Post reply on HN
Print view View original

31–40 of 67 posts

Re: Malicious Use of the HTML5 Vibrate API

#31

Post by freehunter »

AshleysBrain wrote: post #10

Are any of those examples really only convincing if they can vibrate the phone? Surely a scam that just involved that fake call screen while playing a fake ringtone would be more or less just as effective? I can't imagine it's a lot of people who wouldn't be fooled because they think "oh, it's fake, it's not vibrating" who would suddenly be fooled by this.

How many people only have their phones on vibrate and are used to feeling a phone call come in versus hearing/seeing it? Many professional workers would have their phones set up this way. A sudden absence of vibration would just feel weird.

Re: Malicious Use of the HTML5 Vibrate API

#32

Post by exodust »

I thought HTML audio couldn't be auto-played without first receiving a tap from the user? If true, the fake phone call trick wouldn't be possible.

That's the limitation I noticed anyway when I had a quick go at an audio web app a year ago. I couldn't get sounds to play on load without first a tap from user - this was on iOS Safari anyway, I didn't test on other browsers.

Re: Malicious Use of the HTML5 Vibrate API

#34

Post by edent »

exodust wrote: post #32

I thought HTML audio couldn't be auto-played without first receiving a tap from the user? If true, the fake phone call trick wouldn't be possible. That's the limitation I noticed anyway when I had a quick go at an audio web app a year ago. I couldn't get sounds to play on load without first a tap from user - this was on iOS Safari anyway, I didn't test on other browsers.

It depends on the browser. In Firefox, it will autoplay.

But, that said, there's nothing to stop you adding an onClick() event to any part of your page which will then play the audio.

Re: Malicious Use of the HTML5 Vibrate API

#35

Post by judah »

exodust wrote: post #32

I thought HTML audio couldn't be auto-played without first receiving a tap from the user? If true, the fake phone call trick wouldn't be possible. That's the limitation I noticed anyway when I had a quick go at an audio web app a year ago. I couldn't get sounds to play on load without first a tap from user - this was on iOS Safari anyway, I didn't test on other browsers.

This is really a limitation on iOS, see my blog post on the subject here: http://debuggerdotbreak.wordpress.com/2012/06/12/apple-pleas...

It's a limitation that makes it quite annoying to build HTML5 audio apps, which is what my startup does. I have several hacks in my code to accomodate iOS's crippled HTML5 audio implementation.

Re: Malicious Use of the HTML5 Vibrate API

#36

Post by corobo »

hartator wrote: post #18

Can't wait for Adblock for IOS. [However we get less annoying ads because safari don't play flash. Advertisers are obviously moving to different kind of ads adapted to mobile. Anyway it's reasonable to dread for the time that they'll catch up with the desktop ones.]

More annoying ads because they redirect to some random app in the store, blanking the page in the process so you can't even go back to it

Re: Malicious Use of the HTML5 Vibrate API

#37

Post by judah »

theg2 wrote: post #33

Windows Phone, once again safe from the dangers of the Internet standards and features!

Hahah. I just tested this on my Windows Phone, Nokia 925, and yeah, not only does it not vibrate, but it doesn't play the audio.

The audio was a surprise, since it runs my HTML5 radio software just fine. I'm guessing the demo used OGG or some other audio format not supported by mobile IE.

Re: Malicious Use of the HTML5 Vibrate API

#38

Post by judah »

theg2 wrote: post #33

Windows Phone, once again safe from the dangers of the Internet standards and features!

As a side note to web developers dealing with audio: MP3 is really the "plays everywhere" audio format for HTML5 audio.

Firefox was the last holdout, and they capitulated last year [1]; FF for XP and up and FF for Mac now support MP3. There are very few practical reasons not to use MP3.

[1]: http://stackoverflow.com/questions/4923136/why-doesnt-firefo...

Re: Malicious Use of the HTML5 Vibrate API

#40

Post by Zikes »

> It is not impossible to conceive of malicious code being able to exploit an unpatched browser flaw and overdrive the motor to destruction.

Are there not restrictions at the OS or hardware level to prevent this?

Post reply on HN