The Death Of Cookies: Websites Can Use Accelerometers To Identify Your Smartphone

Online behavior tracking by Web advertisement agencies attempting to better target consumers with products and other ads is a pervasive, persistent, and contentious practice on the Internet. The ad firms generally do this by installing small amounts of data on the user’s browser. These data are known as tracking cookies. New research from Stanford University found that the accelerometers in our smartphones produce uniquely identifiable measurements that these firms could exploit to track users even more reliably and accurately, a troubling breakthrough for those that advocate for online privacy.

An accelerometer is more or less a piece of hardware that measures the degree of acceleration experienced by the device it is embedded into. Pragmatically, for a smartphone at least, the accelerometer is the piece of equipment that enables the device to be aware of its orientation and allow you to play those flying and driving-related games.
According to an article in SFGate, researchers from the security lab within Stanford University’s Computer Science department realized that each accelerometer is subtly and uniquely flawed because of nearly unrecognizable variations in the accelerometer manufacturing process. Of course, like most modern manufacturing, the building of accelerometers is largely automated and highly precise, but it is not perfectly precise.
In theory, according to research cited by SFGate, an accelerometer should pick up the weight of gravity on a phone resting on a flat surface and quantify that measure as positive on when the phone is upright and negative one when the screen is facing downward. These measurements end up being close to, but not exactly negative or positive one respectively. As luck would have it, because of these unique manufacturing imperfections, the Stanford researchers believe they can prove that each accelerometer’s output is slightly different from every other accelerometer.
If you haven’t guessed it yet, this of course would mean that measuring the differences in output between different accelerometers is a reliable way of identifying a particular device and, at the very least, the person who owns it, which is generally the person who is using it as well.

New research from Stanford University found that the accelerometers in our smartphones produce uniquely identifiable measurements that these firms could exploit to track users even more reliably and accurately.

Generally, when I read about a uniquely identifiable characteristic, I think about the potential to apply such characteristics – often based on human biometric measures – for device and online authentication in ways that might work better and provide more security than passwords, which are at once completely imperfect and almost entirely universal.
In fact, sometime last year, a different set of researchers realized that apparently identical graphics processors are actually different in subtle, unforgeable ways. A piece of software developed by the researcher working on the “physically unclonable functions found in standard PC components” project is capable of discerning these fine differences. The magnitude of these differences is so minute, in fact, that manufacturing equipment is incapable of manipulating or replicating them. Thus, the fine-grained manufacturing differences can act as a sort of a key to reliably distinguish each of the processors from one another.
It’s not totally clear how or why the Stanford researchers came to believe that advertisers might someday use these measurement to track our behavior online, but we’ll probably be able to figure it out in the near future when Stanford publishes the results of the full research.
You can check if your own phone’s accelerometer is uniquely identifiable by running it through Stanford’s Web-based proof-of-concept.

EU urges cloud computing uptake despite PRISM fallout

The European Commission (EC) has said that concerns over spying and data security in the wake of the PRISM scandal must not stop businesses from taking advantage of the benefits of cloud computing.
Ever since the scandal broke over the summer there have been concerns that the issues PRISM raised over the ability for government spies to access data would cause mistrust of cloud services.
The EC acknowledged this in a briefing document outlining its position on cloud computing use. “Users already had some reservations over security and confidentiality of information in the cloud, but PRISM aggravated this situation. Trust in cloud computing is suffering, which risks depressing the rate of cloud uptake and Europe lagging behind in cloud computing adoption,” it said.
However, the EC said despite this the benefits of cloud services must be recognised and utilised by firms in Europe to achieve the greatest economic potential.
“The cloud puts the best IT solutions within the reach of small firms and organisations,” it said. "These small firms are the bedrock of the European economy, and means the cloud will enable a particularly big leap forward for productivity in Europe if firms can be convinced to use it."
The EC also warned that while some have called for localised cloud initiatives this would further hold back cloud use and see Europe fall further behind in the digital market.
“Fragmentation or segmentation of the cloud computing market along national or regional lines could unfortunately hold back the development of cloud computing in Europe,” it said.
“National-level initiatives in particular where the software systems are adapted to local circumstances will not achieve a scale of rollout that would unlock the full economic benefits of cloud computing.”
The EC added that European firms should seek to build on the PRISM scandal by making themselves seen as the most trustworthy for storing data and running applications.
“Europe can pride itself on high standards for data protection and data security. This could be a competitive advantage for firms complying with these high standards. That is why Europe should aim to be the world’s most secure and trusted region for cloud computing,” he said.
“Second, the potential economies of scale of a truly functioning EU-wide single market for cloud computing, where the barriers to free data flow around the EU are substantially reduced, would be a massive boost to competitiveness."
The EC even went as far as to highlight some of the shortcomings of on-premise security in an effort to underline the benefits of cloud.
"The premises solutions are not completely secure, because they generally lack the ability to call on very high levels of professional security that cloud provisioning can deploy to counter some of the risks of traditional computer provisioning through implementation of more effective authentication, strong cyber defences, and state-of-the-art security implementation," it said.
"The technology systems on which they are based have the same vulnerabilities as cloud-based provisioning and indeed they may be less secure as software implemented in specific enterprise environments usually has extra vulnerabilities because the security features will not be standardised or as fully tested."
The PRISM fallout is still affecting the tech community, with German internet giant Deutsche Telekom pushing forward with plans to try and keep all its web traffic within Germany to avoid the reach of spies.
The use of the spying tactics has also led to legal challenges against the UK government, although the head of UK spy services including MI5 has defended the programmes used as vital for national security.
The latest issue of the V3 Tablet App features an in-depth look at the PRISM scandal and how it is affecting businesses. It also has an in-depth feature with the head of IT at Bet365 and our full review of the iPhone 5S device.