Many Android phones have an integrated magnetometer available to native apps. Chrome browser for Android also makes that capability available to web apps, but right now it is hidden by default as a feature preview. Once I enabled that feature, I was able to follow some sample code online and quickly obtain access to magnetometer data in my own web app. That was so easy! Why was it blocked by default?

Apparently, the answer (or at least a part of it) was that it was too easy. Making magnetometer and other hardware sensor data freely available to web apps would feed into hardware-based browser fingerprinting. Even though magnetometer data by itself might be innocuous, it could be combined with other seemingly-innocent data to uniquely identify users thereby piercing privacy protections. This is bad, and purportedly why Apple has so far declined to support sensor APIs.

That article was in 2020, though, and the web moves fast. When I read up on magnetometer API on MDN (Mozilla Developer Network) I encountered an entire section on obtaining user permission to read hardware sensor data. Since I didn't have to do any of that for my own test app to obtain magnetometer data, I guess this requirement is only present in Mozilla's own Firefox browser. Or perhaps it was merely a proposal hoping to satisfy Apple's official objection to supporting sensor API.

I found no mention of Mozilla's permission management framework in the official magnetometer API specification. There's a "Security and Privacy Considerations" section but it's pretty thin and I don't see how it would address fingerprinting concerns. For what it's worth, "limiting maximum sample frequency" was listed as a potential mitigation, and Chrome 111 only allows up to 10Hz.

Today users like myself have to explicitly activate this experimental feature. And at the top of "chrome://flags" page where we do so, there's an explicit warning that enabling experimental features could compromise privacy. In theory, people opting-in to magnetometer today is aware of potential abuse, but that risk has to be addressed before it's rolled out to everyone. In the meantime, I have opted in and I'm going to have some fun.