It is well known that website owners try to track Internet users, but are blocked by AdBlock or similar services. However, according to the W3C, they can still track users who use countermeasures, by their battery charge data!
How so? A feature added by the W3C to HTML5 allows websites to read the visitor's battery status.
According to security researchers at the International Association for Cryptologic Research, “all information exposed by the battery status API is available without the permission or knowledge of users.”
The W3C's brilliant idea was that if a server could access a user's battery status, it could serve a lighter version of the page to someone with low battery levels, thus providing an "improved web experience."
This API is only implemented in Firefox, Chrome, and Opera at this time as Internet Explorer and Safari browsers do not support it.
The battery properties exposed by web pages include the fields, chargingTime, and dischargingTime by calling the navigator.getBattery() method with JavaScript.
The researchers report that they have already identified about 14 million possible combinations of API battery properties: 40,000 possible discharge time states and 90 possible battery charge states.
“Note that, although this method of leveraging battery data as a login identifier might only work for short periods of time, it can be used against users who can’t help but clear their cookies.”
It sounds like the W3C could do with a lengthy consultation with the IETF, which last year decided that “pervasive monitoring is considered an attack.”
