Google Chrome 97 introduces controversial keyboard API

[harlan4096]

Google Chrome 97 is expected to be released later today. The new stable version of Google Chrome will be rolled out via the browser's automatic updating system starting today.Chrome 97's release was delayed by weeks because of the Holiday period in many parts of the world.  Google Chrome 96, the last major stable release in 2021, was released on November 16, 2021.

The new version of Google Chrome launches with a controversial Keyboard MAP API. The API could not be used previously by certain web experiences because it could not be used inside iframes. Apps such as Microsoft's Office web applications could not make use of the API to detect key presses on keyboard layouts. Keyboard layouts differ depending on the region or language. The change makes the functionality available to web applications that are inside iframes.

Here is the official explanation of why the feature has been implemented:
 

getLayoutMap() used in conjunction with code solves the problem of identifying the actual key pressed in keyboard with different layout maps such as English vs French keyboards, but since getLayoutMap() isn't available in all contexts (can't be used inside iframes), Office web apps like Excel, Word, PowerPoint, etc. that show up as embedded experiences in Outlook Web, Teams, etc. and are running in iframes, can't use this API.

Adding keyboard-map to the allow attribute list solves this problem.

Mozilla, Apple, Brave and other browser developers voiced concerns. One key argument that the companies brought forth against the integration in their browsers was that sites could use the functionality for fingerprinting purposes.

Apple published a response on GitHub, stating:
 

As I've noted in person a while ago, the Keyboard Map API as proposed exposes a high entropy fingerprinting surface. This is not acceptable from privacy perspective. As a result, the WebKit team at Apple is not interested in implementing this feature as currently proposed / spec'ed.

Brave Software, maker of the Brave Browser, had this to say:
 

Brave inherits from Chrome implementation of Keyboard API which does not provide any functionality to the user (only Chrome and Opera support it and, to my knowledge, no site actually uses it). However, the API might be used for fingerprinting.

WICG Keyboard Map Draft mentions that the API can be used for fingerprinting of:

Users who use uncommon ASCII layouts (like Dvorak or Colemak)

Users who use an ASCII layout that doesn’t match the default for the region that they are in. For example, a user in the US with an active UK or French layout.

Mozilla finally added the Keyboard Map API to the list of harmful APIs that it won't implement in the Firefox web browser.

Google will implement the API in Chrome, but many other browsers, even those based on Chromium, won't implement it or will disable the API so that it can't be used by websites.

Interested users can check out the other features of Chrome 97 here.

Now You: what is your preferred browser right now?
...

Continue Reading