Criticizing API IDLE Detection in Chrome 94. Experiments with Rust in Chrome

Enable the default API IDle Detection in Chrome 94 led to Wave Critics with reference to objections from developers Firefox and webkit/safari .

API IDle Detection allows sites to determine the time when the user is inactive, i.e. Does not interact with the keyboard / mouse or performs work on another monitor. The API also allows you to find out the screen keeper or not. Informing about inactivity is carried out through sending notifications after reaching a specified inactivity threshold, the minimum value of which is set in 1 minute.

It is important to note that the application of the IDLE Detection requires an explicit provision of user authority, i.e. If the application tries for the first time to determine the fact of inactivity, the user will be shown a window with a proposal to provide authority or block the operation. To complete the IDLE Detection API in the “Privacy and Security” settings section, a special option is provided (“Chrome: // Settings / CONTENT / IDLEDETITION”).

As applications are called applications for chat, social networks and communications, which can change the status of the user depending on its presence at the computer or to postpone the output of notifications about new messages before the user arrival. API can also be used in kiosk applications to return to the source screen after a certain inactivity time or to disable resource-intensive interactive operations, such as redrawing complex constantly updated diagrams when the user is not at the computer.

The position of opponents of inclusion API IDLE Detection reduces to the fact that the information about the user is on the computer or not can be considered confidential. In addition to useful applications, this API can be used and not for good purposes, for example, for attempts to operate vulnerabilities during the lack of a user or to hide the malicious activity, such as mining. With the help of the APIs under consideration, information about user behavior patterns and the daily rhythm of its work can also be collected. For example, you can find out when the user usually goes for lunch or leaves the workplace. In a mandatory confirmation request for the provision of authority, the following concerns are perceived by Google as insignificant.

/Media reports.