Chapter 55: Screen Orientation & Device APIs

Sensor Privacy, Fingerprinting & Ethics

**Part 11: HTML5 APIs Part 2** — Chapter 55: Screen Orientation & Device APIs

LEARNING OBJECTIVES ⌵
  • Understand device hardware fingerprinting vectors (Battery charging decimal precision, accelerometer calibration noise).
  • Learn how modern browsers throttle sensor sampling rates to prevent acoustic keylogging side-channel attacks.
  • Implement privacy-preserving sensor policies and graceful fallbacks.
  • Enforce the Generic Sensor API Permissions Policy (Permissions-Policy: accelerometer=(), gyroscope=()).
🎬 INTERACTIVE VISUAL PIPELINE Core Architecture Simulation
🌐
1. Input
Directives & Tags
⚙️
2. Parse
Tokenizer & AST
🌳
3. Layout
Box Model & Flow
🎨
4. Render
GPU Paint & Composite
PHASE 1: INPUT & DIRECTIVES
Browser receives declarative markup stream, parsing tag tokens and initializing component state.

📖 The Threat Model: Device Sensor Fingerprinting

Hardware sensors are manufactured with microscopic physical imperfections. A smartphone's gyroscope and accelerometer have unique microscopic calibration biases that allow mathematical trackers to fingerprint and track users across incognito sessions with >95% accuracy!

Furthermore, high-frequency motion sensors (sampling at 500Hz) have been demonstrated to act as microphones capable of capturing acoustic vibrations from user keystrokes.

To mitigate these risks:

  1. Sampling Rate Throttling: Modern browsers cap motion events to 60Hz.
  2. Permission Gating: iOS Safari and Chrome require explicit user permissions (DeviceOrientationEvent.requestPermission()).
  3. Permissions-Policy Governance: Top-level frames can disable sensors entirely via HTTP headers or iframe allow tokens.
Permissions-Policy: accelerometer=(self), gyroscope=(self), magnetometer=()

📌 Key Takeaways

  • Battery and sensor APIs have privacy implications and are restricted or quantized in modern browsers.
  • Always use Permissions Policy headers to disable unused sensor APIs across your application.
  • Request device sensor permissions only when directly necessary for a core user experience (e.g. AR viewing or gaming).
  • --

❓ Knowledge Check

1. Which of the following is correct?

2. Which of the following is correct?