Chrome 56 Quietly Added Bluetooth Snitch API (theregister.co.uk) 229
Richard Chirgwin, writing for The Register: When Google popped out Chrome 56 at the end of January it was keen to remind us it's making the web safer by flagging non-HTTPS sites. But Google made little effort to publicise another feature that's decidedly less friendly to privacy, because it lets websites ask about users' Bluetooth devices and harvest information from them through the browser. That's more a pitch to developers, as is clear in this YouTube video from Pete LePage of the Chrome Developers team. "Until now, the ability to communicate with Bluetooth devices has been possible only for native apps. With Chrome 56, your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API," Google shares in the video. "The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript." In other words, the API lets websites ask your browser "what Bluetooth devices can you see," find out what your fridge, and so on, is capable of, and interact with it.
chromium? (Score:3, Interesting)
Will this affect Chromium as well?
Re: (Score:2, Informative)
chrome://flags/
Web Bluetooth
Disable
Re:chromium? (Score:4)
One could hope. But these days I don't tend to trust off switches, or indicators, like I used to. Better to figure out if there's a way to block it using a security setting untouchable from chrome's privilege level. I fear that patch will lead into dbus-land rather than a sane SELinux policy.
Comment removed (Score:4)
Prepare for the era of Bluetooth spam 2.0 (Score:3)
Prepare for the era of Bluetooth spam 2.0. Now, you don't even need to buy spammer hardware from Chinese, just write a website with bt spam script.
Re: (Score:3)
Only if you are a Chrome user...
Re: (Score:2)
They also said other browsers support same but didn't say anything more specific, such as who and what versions they started supporting it.
Re: (Score:2)
You know Firefox is going to follow suit as they have become Chrome Junior.
Re: (Score:2)
Re: (Score:2)
Do we know at this stage whether this feature requires permission from the user (like going fullscreen)
Going to fullscreen these days do not require permission from the user. Chrome just goes to fullscreen and ask the user afterward. Google wellknowning this a giant security risk have "fixed" this by only allowing https connections to use the fullscreen feature... Because people who wants to do bad things could never get an https certificate.
This will probably be "secured" the same way, as it appears to be Google's goto solution when doing things right is too much bother.
Make it stop! (Score:2)
Google is the new Microsoft which was the computer equivalent of the Fuller Brush salesman shoving his foot in your door. I hope this is OFF by default.
More evil (Score:5, Informative)
Google is doing what advertising companies do (Score:4, Insightful)
So despite all ad blocking efforts from the user, this API provides a great pathway to do some digital fingerprinting and establish a cross-site identity.
You are aware that Google is an advertising company right? People tend to forget this fact and how it will tend to incentivize them as an organization. Your privacy is really of no concern to them unless it creates a PR problem.
Re: (Score:2)
The solution is simple: do not use anything with bluetooth.
Re: (Score:2)
It's a W3C draft [github.io] right now.
Re: (Score:2)
I skimmed and skipped over all but the letters/numbers W3C where it showed they were using their platform but were otherwise unaffiliated. I'd edit my post, but this is Slashdot.
Re: (Score:2)
Yes so they can sell you evil things, ensure you're only doing evil deeds and make sure you're not moistening yourself with any unauthorized substances.
Re: (Score:2)
The cookies and advertising scripts have already identified you long ago. Not to mention all the big names selling metrics to each other.
Re:More evil (Score:4, Informative)
Actually, it is MUCH more insidious than this.
Look at iBeacon or eddystone or equivalents.
Bluetooth beacons enable fine-grained location tracking, at 1/10 of a second intervals.
Retailers and others can place these in stores, track your location and behavior while walking through their store, and match it with a physical person at the register when paying with a credit card.
Re:More evil (Score:5, Insightful)
It makes sense to have the ability for web apps to interface w/BT devices
Care to explain how this makes any sense at all? 'Cause right now all I see is the potential for massive security and real-world safety vulnerabilities.
Would you prefer that it be exclusive to an OS? (Score:2)
Would you prefer that only native apps be able to access Bluetooth devices? Then companies will just make the required native app exclusive to the operating system other than the one that your PC runs. For example, one company might be tempted to make a device's corresponding native app exclusive to macOS. Another might be tempted to make its own exclusive to Windows.
Re:Would you prefer that it be exclusive to an OS? (Score:5, Informative)
Would you prefer that only native apps be able to access Bluetooth devices?
I'd prefer all my "apps" top be applications, personally, with auditable source code that doesn't get automatically "upgraded" under my feet at a schedule of someone else's choosing.
Compiled a Windows app for your Mac lately? (Score:2)
Good luck compiling "auditable source code" that depends on Cocoa for anything other than macOS, particularly if it depends on the parts of Cocoa that GNUstep doesn't replicate. Or vice versa: Good luck compiling a Win32 application and device driver on macOS or Linux. (Wine doesn't run drivers.)
Re: (Score:3)
By definition (this being a web API), the devices that require this already phone home through whatever app and the remote end of the API can be disabled for your old version anyway. This means Linux support where there would normally be none.
Re:Would you prefer that it be exclusive to an OS? (Score:4, Informative)
Hell Yes, I want only native applications to access my Bluetooth devices: Only the apps that I choose to install and only those which I give permission to access Bluetooth devices directly,
That's two layers of security right there that I don't want to trade away.
Building cross-platform apps is another problem.
Re: (Score:2)
Hell Yes, I want only native applications to access my Bluetooth devices: Only the apps that I choose to install [...] Building cross-platform apps is another problem.
But "another problem" is exactly the problem to which I was referring. Good luck "choos[ing] to install" a .msi on your Mac or the contents of a .dmg on your not-Mac.
Misunderstand the technology (Score:3)
This web protocol uses the GATT protocol. That means that the bluetooth devices must be open-protocolled. Therefore, you don't have to worry about closed sourced apps, someone can always build an osx/windows/linux version.
Device classes of which an OS is not yet aware (Score:3)
No, I prefer that no software except the Bluetooth driver recognize a device as being Bluetooth. As far as any application can tell, a Bluetooth headset with microphone should be indistinguishable from any other stereo audio output and mono audio input.
That works because your PC's operating system is aware of "stereo audio output" and "mono audio input" as a device class. Are the major PC operating systems aware of, say, "CNC mill" or "3D printer" as a device class yet?
Re: (Score:2)
I'm not familiar with much else that Bluetooth is useful for, so I suppose there might exist a format where it does not make sense to restrict details to the driver, but I'm having trouble imagining one.
Non-wifi smart things, like a Fitbit would be one. Anything that exists solely to collect data to then be processed by a remote server would qualify.
Re: (Score:2)
Nobody can figure out how to install the Fitbit app on their PC, but they will go to a web site.
If they had sane defaults—like prompting before discovery of BT devices and the user selecting the device to pair with, only showing the device that was allowed and no blanket ability to discover—then it might not be so bad.
Re:More evil (Score:4, Funny)
I wouldn't want to be in Brent Spiner's shoes right now.
It's official. (Score:3, Interesting)
Google has gone completely bat-shit insane. How on earth did they think this was a good idea, let alone actually go forward and implement such a thing in the release product?
Just mind-boggling.
Re: (Score:2, Insightful)
Oh, I understand how this can be very good business tool.
One example: Your company produces a device that can be configured using a webbrower. Your BT enabled widget can now be set up and controlled just by going to a web page. No platform specific code required making it cheaper to set up and maintain. The end result is somewhat respectable.
Of course, this opens up a whole bunch of security holes. Your web browser opens up a BT enabled headset to listen in on the microphone. Even better a BT camera...
Re: (Score:2)
require an admin password to authorize each and every device.
Getting the user in the habit of entering the admin password that often is a good way to phish admin passwords.
Re: (Score:2)
Hopefully they won't have that many BT devices they WANT the web to connect to.
If I'm reading Slashdot and it pops up a window that Slashdot wants to connect to my bedroom video camera* I'm not going to give it permission. The times I want a domain to be able to access a Bluetooth device will be few and far between.
*I don't really have one, just an example
Re: (Score:2)
They want to replace all native apps with web apps, so they can be involved. They already have your webcam, gamepad, speakers, and microphone. This is just the last important piece for them.
Re: (Score:2)
Google has gone completely bat-shit insane. How on earth did they think this was a good idea, let alone actually go forward and implement such a thing in the release product?
Just mind-boggling.
Well it made perfect sense as the follow up to WebUSB and WebMIDI (yes those are real things implemented in Chrome).
Re: (Score:2)
Maybe you forgot that Google has been in that market for two years already [wired.com].
Excuse me, I'm from Computer Services (Score:5, Insightful)
Yea, no problem catching idiots with that...
Re:Excuse me, I'm from Computer Services (Score:4, Interesting)
You laugh, but some refrigerators now have a little speaker that will tweet out a high frequency tone/diagnostic code that a phone tech can receive when you call for service.
Re: (Score:2)
Well... that's great an all, but what would be really cool is if we could take out that whole human intervention and get the diagnostic code directly. An Internet connection to your dryer should do the trick...
Re: (Score:2)
Ok, I clicked 'Accept' to all the prompts, can you tell me the results of the diagnosis?
Also, is it normal that my fridge is trying to cook my ice cream?
Thank you.
If I'm forced to update (Score:2)
This will be the first thing I block.
Connected devices (Score:4, Insightful)
I'll be honest, I just don't get the appeal. What the fuck do my appliances need connectivity for?
Re: (Score:2)
I don't either. I don't intend to buy such appliances. They'll be woefully out of date for most of their useful life. They're often insecure as shipped and I doubt a notable number of them will ever get updates.
Re:Connected devices (Score:5, Interesting)
Not intending to buy such appliances is only an option right now.
We don't know if that option will remain open in the future.
Personally, I think it's good to call out the bullshit now before it gains any momentum.
Re: (Score:2, Funny)
How are the appliances going to join M2M (machine to machine) facebook, if they don't have connectivity? In there they will share funny and not so funny stories of their masters and plot world domination.
Re: (Score:2)
Maybe we'd finally learn what happened to all the missing socks, though.
Re: (Score:2)
IoT . Google wants to control your IoT.
Re: (Score:2)
Do you see what I mean? [wired.com]
Re: (Score:2)
I'm generally in the camp of "If your 2nd factor is an app you're doing it wrong".
2nd factor is pretty worthless if it doesn't require human interaction, otherwise, you get malware working with a keylogger to silently connect over Bluetooth and obtain valid 2nd factor as long as you're within range.
... in a private and secure manner (Score:5, Insightful)
your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API
Given the fact that even the battery API was abandoned for privacy reasons, I just don't believe it is ever possible to do this securely and privately. This is just an attack vector begging to be exploited.
Re: (Score:2)
Given the fact that even the battery API was abandoned for privacy reasons, I just don't believe it is ever possible to do this securely and privately.
Chrome allows filesystem access. You give permission for an app to access a specific location in your filesystem. I don't see why you can't just be asked whether you want to give permission to do Bluetooth things, through the same mechanism.
Re: (Score:2)
The difference being that filesystem access is still gated by the OS.
Re: (Score:2)
Re: (Score:2)
But you can't even trust the tin foil since it's been made with computer-controlled machines.
Re: (Score:2)
yep, computer-controlled machines that get more and sophisticated every year so the tinfoil get thinner and thinner every year but the price still goes up...
180 from "Don't be evil" (Score:3)
Re: (Score:2)
If true, this is a Microsoft level move: "increasing our market share is more important than your security or privacy".
Re: (Score:3)
Re: (Score:2)
This is complete opposite from "Don't be evil". This is outright intrusive and evil.
Big brother is real... he's just not a government employee, nor does he work for Apple or Microsoft.
When Google does absolutely anything that's pro-user and pro-privacy at the cost of advertiser intrusiveness, I'll re-evaluate that statement.
Re: (Score:2)
Re: (Score:2)
Google was a company run by techies. Techies haven't been making the calls for quite some time now - Google's advertising clients do. Or have you been willfully ignorant of the past decade?
Re: (Score:2)
NOBODY can be trusted when it comes to money.
False, send me 10,000$ and I will prove it to you.
Been there, done that, (Score:2)
ActiveX.
Good luck with that. We will need it.
Re: (Score:2)
So this should be called ActiveY? Active, why?
Ransomeware Gold (Score:2)
Re: (Score:2)
There's already microphone and webcam APIs that are just as useful to criminals - but both require permission.
Re: (Score:2)
Rename google-chrome to google-chrome.real. Then create the following shell script and name it google-chrome:
Voila, as long as chrome is running, no Bluetooth. And yes, I'm only semi-joking.
Re: (Score:2)
I suggest creating a group for bt access and change the permissions in /dev so only members of that group can access it instead. I already browse the web using a user that has limited permissions.
Re: (Score:2)
I would be very interested to know how to disable the Bluetooth API in the new versions of Chrome/Chromium. (I run both).
Just wrap all your devices in tinfoil and connect to ground, it works well here...
Makes me miss Microsoft Office macros (Score:2)
This reminds of the good old days when you could run code in documents and infect people with them. The only difference is that at least in that case, this was limited only to documents and only from microsoft. Nowadays, since everything is being to pushed to the web, this is much worse.
Re: (Score:3)
You can still run code in documents. It is one of the major vectors for the spread of Locky.
Granted, Microsoft sets macros disabled by default, but all that's necessary is for the document with the Locky downloader to display "Secure Document: You must click "enable content" in order to view it." Two problems: One, Microsoft's "Click this to let any random malefactor ream you with malicious macros" button is given so innocuous a name as "enable content", and two, way, way too many people fall for it. (
I think it's good (Score:5, Interesting)
My point is that everything that lessens the dependence on native apps is good because then it's less difficult to change platforms.
Re: (Score:2)
Meanwhile, any application developer with half a brain should be making their software in a method that is easily ported to the three major platforms.
But no, we should not expect them to do that. Instead, let's just open the browser up to do everything under the sun and hope nothing goes wrong.
Re: (Score:2)
... making their software in a method that is easily ported to the three major platforms. ...
Not sure what you mean here: AIX , OS2 and Digital Unix?
Granular permissions (Score:2)
Something Android does, or tries to do at least, is to have a granular permissions system for apps. Chrome should do similar for websites, where by default those things capable of causing problems are switched off. For sites that genuinely make good use of Bluetooth (and where the user is happy with this), it should be easy enough to grant permissions. In addition, when it comes to granting permissions, there is the opportunity to add information, and to hide/detect more dangerous choices.
Meet the new boss, same as the old boss. (Score:2)
Now that firefox has withered away and IE "edged" its marketshare into the toilet to the benefit of Chrome its time google start flexing its muscle to abuse its dominate position.
Wow. (Score:3)
"The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript."
Forget ransomware. We're one bluetooth-enabled pacemaker away from hostageware.
"Do not step away from your computer, until you complete the following form to send us 4.9 BTC..."
Not at all (Score:5, Informative)
User permission required (Score:2, Informative)
_The UA MUST inform the user what capabilities these services give the website before asking which devices to entrust to it. If any services in the list arenâ(TM)t known to the UA, the UA MUST assume they give the site complete control over the device and inform the user of this risk. The UA MUST also allow the user to inspect what sites have access to what devices and revoke these pairings._
https://webbluetoothcg.github.io/web-bluetooth/#security-and-privacy
FUD article. Put your fucking pitchforks do
GATT [Generic Attribute Profile - ed] (Score:2)
Re: (Score:2)
I just got done setting up a heart rate monitor on a machine at a clinic where we use a web based software package on firefox.
Great. So now you have to worry about whether Firefox updates and breaks it.
Re: (Score:3)
And Malware reporting fake heart-attacks.
Re: (Score:3)
when no man has ever traveled through all time and space.
But I've done both, as has everyone here.
Show me someone who hasn't traveled through time and space and then maybe I'll pay attention.
You mean this is serious? (Score:2)
Re:The Absurdity of Atheism (Score:4, Interesting)
The real question is, why is such a wall of text, posted by an AC and with a score of -1, auto-expanded to full view while some real comments are not?
Re:The Absurdity of Atheism (Score:4, Funny)
The real question is, why is such a wall of text, posted by an AC and with a score of -1, auto-expanded to full view while some real comments are not?
The power of God.
Re: (Score:2)
It's been awhile since we've had jesus freaks spamming shit here. It's nostalgic of the time when we actually fought against ignorance. Today we're only 'allowed' to fight ignorance when it isn't islam.
The funny thing is that this nutter is almost certainly turning people off to his kooky fairy tale rather than making them interested in it.
Re: (Score:2)
Hey, at least he's not promoting ad-blocking with an unblockable ad.
Re: (Score:2)
What I care about is what your fridge contains, whether I want to eat / drink it, and whether it is equipped to download the contents to me. My concern is whether the bluetooth would be the slowest part of the connection.
Re:Power (Score:5, Funny)
Bluetooth my refrigerator down, and the science projects in it will become more powerful than you can imagine.
Re: (Score:3)
We're sorry but your 19-months-old salad is not a "science project". Throw it away already.
Signed,
your roommates.
Re: (Score:2)
Re: Power (Score:2)
Re: (Score:3)
You have no _idea_ what my fridge is capable of.
As long as it stays cool under pressure.
(Ha, an HVAC joke on /.)
Re: (Score:2)
I don't see how Bluetooth helps with fingerprinting users if the user has to first click "Allow for https://example.com/ [example.com]".
If you are addressing this from a position of objecting to fingerprinting in general: The easiest way to fingerprint users is to require a Google, Facebook, Twitter, Microsoft, or email account login to read past the abstract. As browsers add anti-fingerprinting measures, watch more sites become "free reg. req."
Re: Advancements (Score:2)
Re: (Score:2)
Then somebody has to come up with a tool that fakes all kinds of USB devices at random to fool the trackers...
Re: (Score:2)
err.. damn: BT devices ;-)