Ambient Light Sensor

1. Introduction

The Ambient Light Sensor extends the Generic Sensor API [GENERIC-SENSOR] to provide information about ambient light levels, as detected by the device’s main light detector, in terms of lux units.

1.1. Scope

This document specifies an API designed for use cases which require fine grained illuminance data, with low latency, and possibly sampled at high frequencies.

Common use cases relying on a small set of illuminance values, such as styling webpages according to contrast level or preferred color scheme that may be influenced by a device’s measured ambient light level are best served by the the prefers-contrast and prefers-color-scheme CSS media features [MEDIAQUERIES-5] as well as the accompanying matchMedia API [CSSOM-VIEW-1] and are out of scope of this API.

Note: The [MEDIAQUERIES-5] specification used to contain a light-level media feature that was more directly tied to ambient light readings. It has since been dropped from the specification in favor of the higher-level prefers-color-scheme and prefers-contrast media features.

2. Examples

navigator.mediaDevices.getUserMedia({video: true}).then(() => {
  const sensor = new AmbientLightSensor();
  sensor.onreading = () => console.log(sensor.illuminance);
  sensor.onerror = event => console.log(event.error.name, event.error.message);
  sensor.start();
});

navigator.mediaDevices.getUserMedia({ video: true }).then(() => {
    const als = new AmbientLightSensor({frequency: 20});
    als.addEventListener('activate', () => console.log('Ready to measure EV.'));
    als.addEventListener('error', event => console.log(`Error: ${event.error.name}`));
    als.addEventListener('reading', () => {
        // Defaut ISO value.
        const ISO = 100;
        // Incident-light calibration constant.
        const C = 250;

        let EV = Math.round(Math.log2((als.illuminance * ISO) / C));
        console.log(`Exposure Value (EV) is: ${EV}`);
    });

    als.start();
});

3. Security and Privacy Considerations

Ambient Light Sensor provides information about lighting conditions near the device environment. Potential privacy risks include:

• Profiling. Ambient Light Sensor can leak information about user’s use patterns and surrounding. This information can be used to enhance user profiling and behavioral analysis.

• Cross-device linking. Two devices can access web sites that include the same third-party script that correlates lighting levels over time.

• Cross-device communication. A simple broadcast communication method can use device screen or camera LED flashes to broadcast messages read out with an Ambient Light Sensor in a close by device.

• Cross-origin leaks. Light emitted from the screen can be reflected back to the sensor from nearby reflective surfaces. Malicious sites can embed resources from different origins and scale the content to display particular pixels to allow distinguishing the contents, pixel by pixel.

• Hijacking browsing history. Styling visited links to allow distinguishing the light levels associated with visited and unvisited links i.e. visited links styled as a block of black screen; white for unvisited.

Works such as [ALSPRIVACYANALYSIS], [PINSKIMMINGVIASENSOR], [STEALINGSENSITIVEDATA], and [VIDEORECOGNITIONAMBIENTLIGHT] delve further into these issues.

To mitigate these threats specific to Ambient Light Sensor, user agents must:

• Reduce accuracy of sensor readings. See § 3.1 Reducing sensor readings accuracy.

• Obtain user consent before providing sensor readings. This is done by integrating with the [MEDIACAPTURE-STREAMS] specification. See § 3.2 Active local camera source requirement.

User agents may also limit maximum sampling frequency.

These mitigation strategies complement the generic mitigations defined in the Generic Sensor API [GENERIC-SENSOR].

3.1. Reducing sensor readings accuracy

In order to reduce accuracy of sensor readings, this specification defines a threshold check algorithm (the ambient light threshold check algorithm) and a reading quantization algorithm (the ambient light reading quantization algorithm).

These algorithms make use of the illuminance rounding multiple and the illuminance threshold value. Implementations must adhere to the following requirements for their values:

• The illuminance rounding multiple must be at least 50 lux.

• The illuminance threshold value should be at least half of the illuminance rounding multiple.

Note: Choosing an illuminance rounding multiple requires balancing not exposing readouts that are too precise while also providing readouts that are still useful for API users. The value of 50 lux as a minimum for the illuminance rounding multiple was determined in GitHub issue #13 after different ambient light level measurements under different lighting conditions were gathered and shown to thwart the attack described in [STEALINGSENSITIVEDATA]. 50 lux is also higher than the 5 lux required to make video recognition using ambient light sensor readings ([VIDEORECOGNITIONAMBIENTLIGHT]) infeasible.

Note: The illuminance threshold value is used to prevent leaking the fact that readings are hovering around a particular value but getting quantized to different values. For example, if illuminance rounding multiple is 50, this prevents switching the illuminance value between 0 and 50 if the raw readouts switch between 24 and 26. The efficacy of the threshold check algorithm as an auxiliary fingerprinting mitigation strategy has not been mathematically proven, but it has been added to this specification based on implementation experience. Chromium bug 1332536 and Chromium review 3666917 contain more information about this.

3.2. Active local camera source requirement

Many of the attacks on Ambient Light sensors referenced above rely on being able to access illuminance readouts for a certain amount of time without a user being aware that the data is being read.

[STEALINGSENSITIVEDATA] and [ALSPRIVACYANALYSIS] specifically recommend requesting user permission before allowing access to illuminance readouts as a privacy measure. On the other hand, it can be difficult to convey to users what an Ambient Light Sensor is so that they can make an informed choice to grant or deny access to it.

What this specification does instead is consider an Ambient Light Sensor to be a 1x1 grayscale camera, integrate with the [MEDIACAPTURE-STREAMS] specification and require there to be at least one local camera source that is not muted or stopped in order for illuminance readouts to be provided. In other words, an Ambient Light Sensor only provides readings if a local video camera is currently active and being used in the same window as the AmbientLightSensor instance.

Per the [MEDIACAPTURE-STREAMS] specification, this is only possible if script has called getUserMedia() and granted the "camera" permission. This also means the User Agent has at least indicated to the user that a local camera source has started being used as per Media Capture and Streams §  15. Privacy Indicator Requirements.

The goal of this model is to treat an Ambient Light Sensor as potentially as invasive as an actual camera device and subject it to the same strict privacy requirements together with the Generic Sensor mitigations described in Generic Sensor API § 4 Security and privacy considerations and the other Ambient Light Sensor-specific measures described in this section.

4. Model

The Ambient Light Sensor sensor type’s associated Sensor subclass is the AmbientLightSensor class.

The Ambient Light Sensor has a default sensor, which is the device’s main light detector.

The Ambient Light Sensor’s sensor permission names is an empty set.

Note: See § 3.2 Active local camera source requirement. This specification relies on the permission model specified in the [MEDIACAPTURE-STREAMS] specification instead.

The Ambient Light Sensor is a policy-controlled feature identified by the string "ambient-light-sensor". Its default allowlist is 'self'.

The current light level or illuminance is a value that represents the ambient light level around the hosting device. Its unit is the lux (lx) [SI].

Note: The precise lux value reported by different devices in the same light can be different, due to differences in detection method, sensor construction, etc.

The Ambient Light Sensor has an illuminance rounding multiple, measured in lux, which represents a number whose multiples the illuminance readings will be rounded up to.

The Ambient Light Sensor has an illuminance threshold value, measured in lux, which is used in the ambient light threshold check algorithm.

Note: see § 3.1 Reducing sensor readings accuracy for minimum requirements for the values described above.

5. API

5.1. The AmbientLightSensor Interface

[SecureContext, Exposed=Window]
interface AmbientLightSensor : Sensor {
  constructor(optional SensorOptions sensorOptions = {});
  readonly attribute double? illuminance;
};

To construct an AmbientLightSensor object the user agent must invoke the construct an ambient light sensor object abstract operation.

5.1.1. The illuminance attribute

The illuminance getter steps are:

1. Let illuminance be the result of invoking get value from latest reading with this and "illuminance" as arguments.

2. Return illuminance.

5.1.2. Media Capture and Streams integration

As discussed in § 3.2 Active local camera source requirement, illuminance readouts are provided only if the same Window with an AmbientLightSensor object has at least one local camera source that is not muted or stopped.

The ambient light pre-activation checks algorithm is invoked by start() as specified in [GENERIC-SENSOR].

Furthermore, whenever an item is added to the Window.[[devicesLiveMap]] internal slot, or one of its items has its value changed, implementations MUST run the following steps:

6. Abstract Operations

6.1. Construct an ambient light sensor object

6.2. Ambient light threshold check algorithm

The Ambient Light Sensor sensor type defines the following threshold check algorithm:

Note: This algorithm invokes the ambient light reading quantization algorithm to ensure that readings that round up to the same value do not trigger an update in the main update latest reading algorithm. Not doing so would indicate to users that the raw illuminance readings are within a range where they differ by at least the illuminance threshold value but do not round up to different illuminance rounding multiple.

6.3. Ambient light reading quantization algorithm

The Ambient Light Sensor sensor type defines the following reading quantization algorithm:

6.4. Ambient light pre-activation checks algorithm

The Ambient Light Sensor sensor type defines the following pre-activation checks algorithm:

6.5. Check for active local camera source

7. Automation

7.1. Mock Sensor Type

The AmbientLightSensor class has an associated mock sensor type which is "ambient-light", its mock sensor reading values dictionary is defined as follows:

dictionary AmbientLightReadingValues {
  required double? illuminance;
};

8. Use Cases and Requirements

• A Web application calculates settings for a camera with manual controls (aperture, shutter speed, ISO).

• A Web application checks the current light level to determine whether a camera stream will contain data that is accurate enough for its purposes (e.g. human presence verification).

While some of the use cases may benefit from obtaining precise ambient light measurements, the use cases that convert ambient light level fluctuations to user input events would benefit from higher sampling frequencies.

Note: A previous version of this specification did not require an active camera and did not integrate with the [MEDIACAPTURE-STREAMS] specification. It allowed for a wider range of use cases, such as providing input smart home systems to control lighting or checking whether the light level at a work space is sufficient.

9. Acknowledgements

Doug Turner for the initial prototype and Marcos Caceres for the test suite.

Paul Bakaus for the LightLevelSensor idea.

Mikhail Pozdnyakov and Alexander Shalamov for the use cases and requirements.

Lukasz Olejnik for the privacy risk assessment.