Websites can track people across internet with battery status API: study
03 Aug 2016
Websites may be tracking people across the internet by checking their device battery life - and might even be hoping to panic users into spending money.
This is the conclusion of researchers at Princeton University in the US, who surfed the top million websites to see what type of tracking they used.
The report noted that the idea of "fingerprinting" a user via battery status was first mooted last year.
According to researchers Steve Engelhard and Arvind Narayanan the websites were actually using the technique, with scripts combining charge level status, time to recharge and more with other identifying features including IP address.
The data was leaked via an API released as part of HTML5 in 2015, which was created to allow developers serve a version of an app or site that was less of a drain on batteries for users whose charge is running low.
The research also found that audio, WebRTC (real-time communications) and fonts for "fingerprinting", were also being used apart from the battery API.
The report noted that existing tracking-protection tools - such as Ghostery – were effective at countering standard tracking techniques, but were not ''effective at detecting these newer and more obscure fingerprinting techniques."
The battery status API was introduced in HTML5, the fifth version of the code used to structure web content and had already shipped in Firefox, Opera and Chrome by August 2015.
It allowed site owners to see the percentage of battery life left in a device, as also the time it would take to discharge or the time it will take to charge, if connected to a power source.
The API was intended to allow site owners to serve low-power versions of sites and web apps to users with little battery capacity left, but its potential to allow web sites to spy on users had been pointed out by privacy researchers.
The combination of battery life as a percentage and battery life in seconds offered 14 million combinations, providing a pseudo-unique identifier for each device.
