Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Chrome Privacy Your Rights Online

Chrome 56 Quietly Added Bluetooth Snitch API (theregister.co.uk) 229

Richard Chirgwin, writing for The Register: When Google popped out Chrome 56 at the end of January it was keen to remind us it's making the web safer by flagging non-HTTPS sites. But Google made little effort to publicise another feature that's decidedly less friendly to privacy, because it lets websites ask about users' Bluetooth devices and harvest information from them through the browser. That's more a pitch to developers, as is clear in this YouTube video from Pete LePage of the Chrome Developers team. "Until now, the ability to communicate with Bluetooth devices has been possible only for native apps. With Chrome 56, your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API," Google shares in the video. "The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript." In other words, the API lets websites ask your browser "what Bluetooth devices can you see," find out what your fridge, and so on, is capable of, and interact with it.
This discussion has been archived. No new comments can be posted.

Chrome 56 Quietly Added Bluetooth Snitch API

Comments Filter:
  • chromium? (Score:3, Interesting)

    by Anonymous Coward on Monday February 06, 2017 @01:03PM (#53812987)

    Will this affect Chromium as well?

    • Re: (Score:2, Informative)

      by Anonymous Coward

      chrome://flags/
      Web Bluetooth
      Disable

      • by skids ( 119237 ) on Monday February 06, 2017 @02:18PM (#53813579) Homepage

        One could hope. But these days I don't tend to trust off switches, or indicators, like I used to. Better to figure out if there's a way to block it using a security setting untouchable from chrome's privilege level. I fear that patch will lead into dbus-land rather than a sane SELinux policy.

        • by hairyfeet ( 841228 ) <bassbeast1968@@@gmail...com> on Monday February 06, 2017 @03:29PM (#53814107) Journal

          Yeah we've seen how well switches work with Windows 10 which still phones home to spam your data no matter how many switches you flip.

          As for TFA? Can we all accept that "Don't Be Evil" was nothing but marketing bullshit, no different than "Where Do You Want To Go Today?" or "Think Different" and had the same amount of effect on corporate policy as the other two catch phrases, IE none? As someone who was a big fan of Google (still remember how giddy I was when I got invited to the Gmail alpha) sadly it looks like my theory was right, that all corps simply become evil when they reach a certain size. Its like there is this threshhold, this line in the sand where before they reach that line they are just another company but once they reach a certain level of entrenchment and profitability? They go from coming up with cool new ideas and products to figuring out how to fuck competition with lobbying and doing any move to maximize profits no matter how sleazy and underhanded.

          Its a fucking shame as Google used to be this cool think tank filled with super smart uber nerds that just threw cool new ideas at the wall and see what stuck, now they are just as douchey as MSFT and Apple, just another corp happy to assfuck their customers if it nets them another couple percentage points in profits they can show on the quarterly earnings report.

  • by fubarrr ( 884157 ) on Monday February 06, 2017 @01:07PM (#53813009)

    Prepare for the era of Bluetooth spam 2.0. Now, you don't even need to buy spammer hardware from Chinese, just write a website with bt spam script.

    • Only if you are a Chrome user...

      • They also said other browsers support same but didn't say anything more specific, such as who and what versions they started supporting it.

    • Do we know at this stage whether this feature requires permission from the user (like going fullscreen), or just happens without the user having any control over what's going on (like autoplaying videos)?

      If the former, it's going to be hard to spam people, and it kinda makes sense as an API given the move to shift desktop applications to the web. If the latter, I'm uninstalling Chrome and f--- em.

      • Do we know at this stage whether this feature requires permission from the user (like going fullscreen)

        Going to fullscreen these days do not require permission from the user. Chrome just goes to fullscreen and ask the user afterward. Google wellknowning this a giant security risk have "fixed" this by only allowing https connections to use the fullscreen feature... Because people who wants to do bad things could never get an https certificate.

        This will probably be "secured" the same way, as it appears to be Google's goto solution when doing things right is too much bother.

    • Google is the new Microsoft which was the computer equivalent of the Fuller Brush salesman shoving his foot in your door. I hope this is OFF by default.

  • More evil (Score:5, Informative)

    by JaredOfEuropa ( 526365 ) on Monday February 06, 2017 @01:11PM (#53813041) Journal
    So despite all ad blocking efforts from the user, this API provides a great pathway to do some digital fingerprinting and establish a cross-site identity. And if you happen to log in on certain sites that use this, they will be able to establish your real identity on any other site from there on in as well.
    • by sjbe ( 173966 ) on Monday February 06, 2017 @01:49PM (#53813379)

      So despite all ad blocking efforts from the user, this API provides a great pathway to do some digital fingerprinting and establish a cross-site identity.

      You are aware that Google is an advertising company right? People tend to forget this fact and how it will tend to incentivize them as an organization. Your privacy is really of no concern to them unless it creates a PR problem.

    • The solution is simple: do not use anything with bluetooth.

    • Yes so they can sell you evil things, ensure you're only doing evil deeds and make sure you're not moistening yourself with any unauthorized substances.

    • The cookies and advertising scripts have already identified you long ago. Not to mention all the big names selling metrics to each other.

    • Re:More evil (Score:4, Informative)

      by Polo ( 30659 ) * on Monday February 06, 2017 @04:48PM (#53814681) Homepage

      Actually, it is MUCH more insidious than this.

      Look at iBeacon or eddystone or equivalents.

      Bluetooth beacons enable fine-grained location tracking, at 1/10 of a second intervals.

      Retailers and others can place these in stores, track your location and behavior while walking through their store, and match it with a physical person at the register when paying with a credit card.

  • It's official. (Score:3, Interesting)

    by werewolf1031 ( 869837 ) on Monday February 06, 2017 @01:21PM (#53813107)

    Google has gone completely bat-shit insane. How on earth did they think this was a good idea, let alone actually go forward and implement such a thing in the release product?

    Just mind-boggling.

    • Re: (Score:2, Insightful)

      Oh, I understand how this can be very good business tool.

      One example: Your company produces a device that can be configured using a webbrower. Your BT enabled widget can now be set up and controlled just by going to a web page. No platform specific code required making it cheaper to set up and maintain. The end result is somewhat respectable.

      Of course, this opens up a whole bunch of security holes. Your web browser opens up a BT enabled headset to listen in on the microphone. Even better a BT camera...

      • by tepples ( 727027 )

        require an admin password to authorize each and every device.

        Getting the user in the habit of entering the admin password that often is a good way to phish admin passwords.

        • Hopefully they won't have that many BT devices they WANT the web to connect to.

          If I'm reading Slashdot and it pops up a window that Slashdot wants to connect to my bedroom video camera* I'm not going to give it permission. The times I want a domain to be able to access a Bluetooth device will be few and far between.

          *I don't really have one, just an example

    • They want to replace all native apps with web apps, so they can be involved. They already have your webcam, gamepad, speakers, and microphone. This is just the last important piece for them.

    • Google has gone completely bat-shit insane. How on earth did they think this was a good idea, let alone actually go forward and implement such a thing in the release product?

      Just mind-boggling.

      Well it made perfect sense as the follow up to WebUSB and WebMIDI (yes those are real things implemented in Chrome).

  • by ausekilis ( 1513635 ) on Monday February 06, 2017 @01:22PM (#53813113)
    "Excuse me, I'm from the computer services group, and your A/C appears to be acting up... It's reporting . Please go to this website and click 'Accept' to all the prompts and we can diagnose it remotely".

    Yea, no problem catching idiots with that...
    • by Anonymous Coward on Monday February 06, 2017 @02:07PM (#53813509)

      You laugh, but some refrigerators now have a little speaker that will tweet out a high frequency tone/diagnostic code that a phone tech can receive when you call for service.

    • Ok, I clicked 'Accept' to all the prompts, can you tell me the results of the diagnosis?

      Also, is it normal that my fridge is trying to cook my ice cream?

      Thank you.

  • This will be the first thing I block.

  • Connected devices (Score:4, Insightful)

    by grasshoppa ( 657393 ) <`gro.oc-onpt' `ta' `ydenneks'> on Monday February 06, 2017 @01:23PM (#53813125) Homepage

    I'll be honest, I just don't get the appeal. What the fuck do my appliances need connectivity for?

    • I don't either. I don't intend to buy such appliances. They'll be woefully out of date for most of their useful life. They're often insecure as shipped and I doubt a notable number of them will ever get updates.

    • Re: (Score:2, Funny)

      by Anonymous Coward

      How are the appliances going to join M2M (machine to machine) facebook, if they don't have connectivity? In there they will share funny and not so funny stories of their masters and plot world domination.

    • by Lisias ( 447563 )

      IoT . Google wants to control your IoT.

  • by Errol backfiring ( 1280012 ) on Monday February 06, 2017 @01:28PM (#53813177) Journal

    your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API

    Given the fact that even the battery API was abandoned for privacy reasons, I just don't believe it is ever possible to do this securely and privately. This is just an attack vector begging to be exploited.

    • Given the fact that even the battery API was abandoned for privacy reasons, I just don't believe it is ever possible to do this securely and privately.

      Chrome allows filesystem access. You give permission for an app to access a specific location in your filesystem. I don't see why you can't just be asked whether you want to give permission to do Bluetooth things, through the same mechanism.

      • by sl3xd ( 111641 )

        The difference being that filesystem access is still gated by the OS.

      • All fine and good until the next browser vulnerability. Chrome is one of the better browsers security wise (at least compared to Firefox) but their is still a regular flow of vulnerabilities. Add in stupid users who click yes to anything as they don't understand the implications.
  • by sinij ( 911942 ) on Monday February 06, 2017 @01:32PM (#53813227)
    This is complete opposite from "Don't be evil". This is outright intrusive and evil.
    • by kbonin ( 58917 )

      If true, this is a Microsoft level move: "increasing our market share is more important than your security or privacy".

    • by sl3xd ( 111641 )

      This is complete opposite from "Don't be evil". This is outright intrusive and evil.

      Big brother is real... he's just not a government employee, nor does he work for Apple or Microsoft.

      When Google does absolutely anything that's pro-user and pro-privacy at the cost of advertiser intrusiveness, I'll re-evaluate that statement.

  • ActiveX.

    Good luck with that. We will need it.

  • How long before the criminals use the Bluetooth connection to turn off various important household systems? When it's -10 degrees F/ -23 C in the upper Midwest of the US and in Canada it is highly inconvenient to get a message to the effect that "Your Carrier Xfinity Furnace has been turned off and locked by us by remotely disabling the furnace control board firmware. To receive the code to unlock it and restore heat in your house, please submit 2 Bitcoin (about US$ 2000) to the following account before you
    • There's already microphone and webcam APIs that are just as useful to criminals - but both require permission.

    • by mvdwege ( 243851 )

      Rename google-chrome to google-chrome.real. Then create the following shell script and name it google-chrome:

      #!/bin/sh

      sudo modprobe -r btusb
      google-chrome.real
      sudo modprobe btusb

      Voila, as long as chrome is running, no Bluetooth. And yes, I'm only semi-joking.

      • by ls671 ( 1122017 )

        I suggest creating a group for bt access and change the permissions in /dev so only members of that group can access it instead. I already browse the web using a user that has limited permissions.

    • by ls671 ( 1122017 )

      I would be very interested to know how to disable the Bluetooth API in the new versions of Chrome/Chromium. (I run both).

      Just wrap all your devices in tinfoil and connect to ground, it works well here...

  • This reminds of the good old days when you could run code in documents and infect people with them. The only difference is that at least in that case, this was limited only to documents and only from microsoft. Nowadays, since everything is being to pushed to the web, this is much worse.

    • You can still run code in documents. It is one of the major vectors for the spread of Locky.

      Granted, Microsoft sets macros disabled by default, but all that's necessary is for the document with the Locky downloader to display "Secure Document: You must click "enable content" in order to view it." Two problems: One, Microsoft's "Click this to let any random malefactor ream you with malicious macros" button is given so innocuous a name as "enable content", and two, way, way too many people fall for it. (

  • I think it's good (Score:5, Interesting)

    by iampiti ( 1059688 ) on Monday February 06, 2017 @02:07PM (#53813517)
    ...provided that the user is informed when a website wants to use it and it's strictly opt in. Firefox works this way regarding sharing of location information.
    My point is that everything that lessens the dependence on native apps is good because then it's less difficult to change platforms.
    • Yes, let's open up web browsers into becoming a huge security and privacy invasion vector so you don't need to use "native apps" because it's "difficult to change platforms".

      Meanwhile, any application developer with half a brain should be making their software in a method that is easily ported to the three major platforms.

      But no, we should not expect them to do that. Instead, let's just open the browser up to do everything under the sun and hope nothing goes wrong. /s
      • by ls671 ( 1122017 )

        ... making their software in a method that is easily ported to the three major platforms. ...

        Not sure what you mean here: AIX , OS2 and Digital Unix?

  • Something Android does, or tries to do at least, is to have a granular permissions system for apps. Chrome should do similar for websites, where by default those things capable of causing problems are switched off. For sites that genuinely make good use of Bluetooth (and where the user is happy with this), it should be easy enough to grant permissions. In addition, when it comes to granting permissions, there is the opportunity to add information, and to hide/detect more dangerous choices.

  • Now that firefox has withered away and IE "edged" its marketshare into the toilet to the benefit of Chrome its time google start flexing its muscle to abuse its dominate position.

  • by SeaFox ( 739806 ) on Monday February 06, 2017 @04:40PM (#53814625)

    "The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript."

    Forget ransomware. We're one bluetooth-enabled pacemaker away from hostageware.
    "Do not step away from your computer, until you complete the following form to send us 4.9 BTC..."

  • Not at all (Score:5, Informative)

    by Assembler ( 151753 ) on Monday February 06, 2017 @04:50PM (#53814699)
    Is this even a tech blog anymore? These assumptions about privacy loss only make sense if you haven't done even the most trivial reading of the spec. The docs are here: https://developers.google.com/... [google.com] A site can request to connect to a bluetooth device. Chrome prompts the user for which one (or none), and the website can then interact with the selected device. I did less than a minute's worth of research. It's even mentioned in the article, but then the article just goes on to assume that the user has granted permission to the page to access every device they have somehow. Maybe I've missed something, but nobody seems to be talking about the actual implementation.
  • by Anonymous Coward

    _The UA MUST inform the user what capabilities these services give the website before asking which devices to entrust to it. If any services in the list arenâ(TM)t known to the UA, the UA MUST assume they give the site complete control over the device and inform the user of this risk. The UA MUST also allow the user to inspect what sites have access to what devices and revoke these pairings._

    https://webbluetoothcg.github.io/web-bluetooth/#security-and-privacy

    FUD article. Put your fucking pitchforks do

  • Thanks msmash (ed), it is nice to have it explained that TT stands for Profile.

What good is a ticket to the good life, if you can't find the entrance?

Working...