Wrappers for Generic Sensor API. More...

Functions
	if (doNoise===true)

Variables
var	doNoise = args[1]

var	pastValues = {}

	$

var	offsetCompStartPageStart = undefined

var	wrappers

Detailed Description

Wrappers for Generic Sensor API.

See also: https://www.w3.org/TR/generic-sensor/

Author: Copyright (C) 2021 Radek Hranicky

License:: SPDX-License-Identifier: GPL-3.0-or-later

MOTIVATION The risk of using Generic Sensor API calls for device fingerprinting is mentioned within the W3C Candidate Recommendation Draft, 29 July 2021 (https://www.w3.org/TR/2021/CRD-generic-sensor-20210729/#device-fingerprinting) Documented threats include manufacturing imperfections and differences that are unique to the concrete model of the device and can be used for fingerprinting.

We discovered another loophole in the Sensor.timestamp attribute. The value describes when the last Sensor.onreading event occurred, in millisecond precision. We observed the time origin is not the time of browsing context creation but the last boot time of the device. Exposing such information is dangerous as it allows to fingerprint the user easily. It is unlikely that two different devices will boot at exactly the same time.

Tested with the Magnetometer sensor on the following devices:

Samsung Galaxy S21 Ultra; Android 11, kernel 5.4.6-215566388-abG99BXXU3AUE1, Build/RP1A.200720.012.G998BXXU3AUE1 Chrome 94.0.4606.71 and Kiwi (Chromium) 94.0.4606.56
Xiaomi Redmi Note 5; Android 9, kernel 4.4.156-perf+, Build/9 PKQ1.180901.001 Chrome 94.0.4606.71

WRAPPING

The wrapper thus protects device by changing the time origin to the browsing context creation time, whereas the timestamp should still uniquely identify the reading. This is achieved in the following way:

At the first reading, we calculate the difference between the original value and performance.now(). This gives us the offset between 1) the device boot and 2) the page context initialization.
On every reading, the offset is subtracted from the original value. The resulting value then uniquely identifies the reading sample without exposing the boot time.
Like in the other time precision wrappers, the resulting timestamp is processed by the mitigation function before return. The mitigation may round and (optionally) add noise to the resulting timestamp.

POSSIBLE IMPROVEMENTS in protection level 2, the timestamp origin may be set to a random value based on the session hash. This can serve as a "fake boot time."

Function Documentation

◆ if()

if ( doNoise = == true )

Variable Documentation

◆ $

$

Initial value:

{rounding_function}
        ${noise_function}
        var mitigationF = rounding_function

◆ doNoise

var doNoise = args[1]

◆ offsetCompStartPageStart

var offsetCompStartPageStart = undefined

◆ pastValues

var pastValues = {}

◆ wrappers

var wrappers

Functions

Variables