Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Can you share more details about the battery status API tracking? Would love to see how that correlates to a unique user.


It's all about adding bits of information to improve confidence in tracking users across pages.

Lets assume that in page visits <10 minutes apart, a users battery won't change by more than 10%.

So say I go to volvo.com and then reddit.com - and my battery changes from 10% to 8%. When I request reddit.com - the user is clearly not a visitor who has had >20% battery. We also know the resolution of the phone. We know the user agent. And many other factors. Combining all of these means that you approach 100% certainty that it's the same user. No information on it's own is identifiable - but by combining enough sources - no two machines or phones are identical (at least that's what advertisers hope)


This is scarily close to how intelligence agencies infer information. If you ever wonder why government is so clandestine about even unclassified bits of data, consider how they could be used when combined. As someone else said, just imagine if they focused their efforts on something useful. Intelligence agencies basically are focusing on "something useful".


I see the relation - but it's also how nearly all information is gathered and infered - even at a human level. You take incomplete information, look at the landscape, and try to fill in the blanks.

A friend you're meeting tells you he's in the starbucks with a red shirt. That's not enough information to know his exact coordinates. But you combine and infer - you know how many starbucks there are in the vicinity, and which one he's likely to be at. You know he's in a red shirt - but there's several people. Luckily you already know his height well enough to filter out false positives within milliseconds.

The method I don't find intrinsically scary - but perhaps the scale and depth at which it happens, and for what motives.


It comes [this paper](https://eprint.iacr.org/2015/616.pdf) which made the HN front page at its time. The battery API exposes information about the current charge of the battery and its full charge capacity that is apparently a non-negligible fingerprinting vector for short-term tracking.


Battery status API support is pretty bad on mobile, but you could look at the rate of battery discharge which would probably be slightly different between devices etc.

Similar to how time skew is used for tracking as clocks go off sync.


Just a guess... your battery level isn't going to change dramatically from second to second. If its provided with a high degree of precision, it would be a pretty good short term key.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: