Your phone has a host of sensors that are used to adjust your phone's orientation, motion, IR light detection, and biometric authentication. While mobile apps require you to grant access to data that needs to be collected from your phone's sensors, there are no such rules for websites.
Researchers have revealed that out of the 100,000 websites ranked according to Alexa Ranking, 3,695 have access to your mobile sensors.
Websites can only access sensors when the user is browsing the site, not in the background. However, malicious third parties combined with the lack of any structure for granting permissions to access your mobile sensors can have serious consequences.
For example, websites can influence users' browsing history with the help of lighting sensors, data collected from motion sensors can be used as keylogger to identify your PIN.
Researchers have discovered that leading browsers, including Chrome, Edge, Safari, Firefox, Brave, Focus, Dolphin, Opera Mini, and UC Browser, allow websites to use your phone's motion and orientation sensors without your permission.
Recent versions of Firefox have revoked permissions to allow websites to leverage your phone's motion and orientation sensors. Additionally, ad blockers have failed to stop scripts from accessing sensors.
The researchers found that 1200 websites use the tracking and analytics sensors, while 63% of the total websites tested use motion sensors and biometric sensors for tracking.
Popular news sites like Wired, CNN, Los Angeles Times, and CNET use advertising messages that contain scripts to use your phone's sensors.
“There are differences between web scripts compared to those in applications, and many of them are legitimate. But the fact that access can be granted without the user’s consent is surprising,” says one of the researchers involved in the study.
According to the researchers, there should be a set of rules regarding how the phone's sensors are used, and users should be in control.
