Up to today, sites get real-time access to device sensors by default when opened with Firefox Mobile on Android, and it seems there is no setting that stops this access.
I believe that, given the privacy implications and the potential performance gains to be had on mobile, it is worth the effort to follow other browsers’ steps in disabling this access by default.
A resource I find useful on diving a bit deeper on this topic is the site at “sensor-js dot xyz”. Notable quotations from the study:
- “… sensor APIs were accessed on 3695 of the 100K websites by scripts served from 603 distinct domains. Orientation and motion sensors are by far the most frequently accessed, on 2653 and 2036 sites respectively. Light and proximity sensors, which were only supported by Firefox[1], are accessed on fewer than 200 sites each.”
- “… sensor data are commonly used for tracking and analytics, verifying ad impressions …”
- “… a large fraction of the scripts that access sensors also perform browser fingerprinting.”
As always, it’d be great to have others’ thoughts on this
