I dunno about the poster you were responding to, but any time the massive worldwide spying platform I can't not use gains more capabilities I'm not really thrilled about it. Even if the security against exploits is somehow perfect, it'll leak data. It'll be used to spy on us. The whole platform became hopelessly pwned when we started letting any ol' page send data without explicit user action and say-so. The by-design low effort and rapid linking between documents never should have been coupled with the capabilities of Javascript.
I wouldn't be concerned about random apps hijacking my peripherals since I assume they will always need some kind of prompt to make a connection. However, if the browser bluetooth API allows you to scan devices I would be more concerned about fingerprinting.
The beacon sends out a signal which is a the same as the connection advertising format, but with the CONNECTABLE bit turned off. This gives 20-30 bytes or so of data you can stuff out there along with the UUID.
The app typically listens for UUIDs of beacons it cares about, and when it sees it, collects the one-way device to app beacon data. Then does something with that -
It's just that the "something" is usually reporting to a website that the beacon has been seen. This is entirely how TILE find-it tags work.
So the threat model here is that if you can get someone to go to your website, you could potentially see what BLE beacons are near that device and report them.
I am not sure if SCANNING requires user consent - or just connection event does.
It'd be remarkable if it wasn't used for spying, given the history of features added to web Javascript. When has an API that gives JS access to more data or device capabilities not been used in this way? Often spying's among the top use cases in the wild for a new feature. At a minimum it'll be another dimension for fingerprinting.
This is not about technical consent, or misleading people. It is about a dialog that pops up when a page wants to access a specific Bluetooth device, and it has to know what kind of device beforehand. Webpages don't just get free reign to scan and access devices.
I'm sure a lot of people also don't realize that Google Chrome has had, for many years, an extension API for accessing USB devices. Has it been a problem? No.
This is just another communication protocol. It's reasonable for browsers to provide a strictly controlled environment to utilize it.
Yes it's a problem. My 85 year old grandmother was redirected to a strange website and was prompted for a series of chrome permissions, including to her computer's audio system. Conditioned to accept internet prompts from legitimate companies, she accepted and was then threatened and harassed verbally until in a panicked frenzy she gave the "voice" her banking and other personal information.
Google, Facebook, and many other technology companies, have conditioned users to click 'Yes' and 'Accept All' and 'Share' such that we can no longer use such prompts to block malicious actors from our computer systems.
I do not trust software engineers to make the correct choice between "ooh a cool feature" and the general well being and privacy of their users. There has been too much precedent and incentivization for the former, including massive profit and promotional tracks.
That really has nothing to do with your initial assertion and frankly is dealing with an entirely unrelated problem. I can't untangle all of the things being conflated here.
I don't think it's terrifying, personally, but it strikes me as a little tone-deaf of Google to use the example of giving a website access to your heart rate monitor [1] which is an demo also linked in this thread. A lot of people assume that any new feature in the javascript API will get used in ad-tech and they aren't often proven wrong with that assumption. I find it unsettling to think about advertisers gaining access to biometric data through the web.
On the other hand it's also something that lowers the barrier-of-entry to BLE hacking to something that people like me can do.
Right now the home privacy conversation is happening in the context of technology controlled by Apple and Google. These are huge companies that are sensitive to public scrutiny and criticism from high-profile media outlets, which creates the possibility for norms to be set in a positive way.
If every shady website has the ability to perform surveillance through personal devices, it will happen a lot. Because it happens a lot, people will get used to it. Once people are used to it, they will accept it. Once they accept it, it will be acceptable. Once it becomes acceptable, Apple and Google will do it. Once Apple and Google do it, it will be impossible for anyone to escape, short of becoming a digital hermit.
Apple and Google both approach this in very different ways. Apple is generally default closed, while Google is generally default open. See the way iOS vs Android has developed, or the way Blink has developed since forking Webkit.
Amusingly, the commentor you're replying to also agrees (while disliking it) in another thread[0]:
> It's just too bad Apple has turned from an early adopter to a slow follower regarding Web API's
In the sense of maintaining my privacy (and security!), I'm personally glad. I'd rather fewer features today in exchange for fewer privacy (and security) breaches tomorrow. Not that Apple's software QA has been great these days anyway...
