• GeneralPixel 7
  • Is GrapheneOS purposefully hiding input device type from browsers?

I've just discovered something strange.

CSS "pointer" media query is a browser mechanism which allows sites to display different content basing on whenever a user is using a precise input device (like mouse or stylus) or an imprecise (like finger). This means that normally this value is set to "fine" on desktop and "coarse" on mobile devices.

However, strangely enough, this value is always "precise" on GrapheneOS and this is consistent between different web browsers. This causes some websites to render smaller buttons, which are harder to hit with a touch screen.

I'm wondering whenever this is a purposeful security/privacy mechanism or rather just a bug, what do you think?

    gieted

    I'm wondering whenever this is a purposeful security/privacy mechanism or rather just a bug, what do you think?

    Neither. It's up to the browsers and works the same way on GrapheneOS.

      GrapheneOS

      Thanks for your response.

      It's up to the browsers

      But the browser is probably taking this value from the operating system, am I right? Otherwise I find it hard to explain why both Firefox, Vanadium and Brave are reporting a fine pointer.

      Could you check it on your phone? Go to this website:
      https://developer.mozilla.org/en-US/docs/Web/CSS/@media/pointer#result

      If color of the "Lool at me!" square is blue then your browser is reporting a fine pointing device and if it's red then it's correctly detecting a touch screen.

      I've never seen any mobile browser reporting primary pointer as fine before. Some web frameworks are even using this value for a platform detection to distinguish between desktop Linux and Android.

        gieted This isn't different on GrapheneOS compared to AOSP and the stock Pixel OS. Your particular configuration is what's abnormal, not GrapheneOS.

          GrapheneOS

          I've looked into this issue more, the Android API which Firefox and probably also other browsers use in order to determine pointer type is android.view.InputDevice. I've written some Android code to check which value is returned by GrapheneOS and the stock ROM.

          class MainActivity : ComponentActivity() {
              override fun onCreate(savedInstanceState: Bundle?) {
                  super.onCreate(savedInstanceState)
                  setContent {
                      val devices = InputDevice.getDeviceIds().map { InputDevice.getDevice(it) }
                      Column {
                          devices.forEach {
                              Text(text = getInput(it))
                          }
                      }
                  }
              }
          }
          
          private fun getInput(inputDevice: InputDevice): String {
              val sources = inputDevice.sources
              return when {
                  hasInputDeviceSource(sources, InputDevice.SOURCE_MOUSE) -> "MOUSE"
                  hasInputDeviceSource(sources, InputDevice.SOURCE_STYLUS) -> "STYLUS"
                  hasInputDeviceSource(sources, InputDevice.SOURCE_TOUCHPAD) -> "TOUCHPAD"
                  hasInputDeviceSource(sources, InputDevice.SOURCE_TRACKBALL) -> "TRACKBALL"
                  hasInputDeviceSource(sources, InputDevice.SOURCE_TOUCHSCREEN) -> "TOUCHSCREEN"
                  hasInputDeviceSource(sources, InputDevice.SOURCE_JOYSTICK) -> "JOYSTICK"
                  else -> "UNKNOWN"
              }
          }
          private fun hasInputDeviceSource(sources: Int, inputDeviceSource: Int): Boolean {
              return sources and inputDeviceSource == inputDeviceSource
          }

          When I run this app on the stock ROM it shows:
          UNKNOWN
          UNKNOWN
          UNKNOWN
          TOUCHSCREEN

          And for GrapheneOS it's:
          UNKNOWN
          UNKNOWN
          UNKNOWN
          STYLUS

          So the app thinks the user is using a stylus, despite he is in fact using a touch screen. For me, it looks either as a bug or a purposeful anti-fingerprinting mechanism.

          Could you check whenever you are getting the same results on your installation or GrapheneOS? You can use the method I've described in my previous comment, which doesn't involve having to build an Android app.

          gieted If color of the "Lool at me!" square is blue then your browser is reporting a fine pointing device and if it's red then it's correctly detecting a touch screen.

          I get a red square with Vanadium on a 6a.

          I am getting a red border-color on Mozilla's test page as well. Using a Pixel 6 with latest GOS on normal release channel. I tried this both in Vanadium and in Firefox. What kind of device are you using?

          I'm getting a blue checkbox on Mozilla's test page with Vanadium on Pixel 7.

          22 days later

          Thanks for your responses. I'm also using Pixel 7 and getting a blue checkbox, therefore it looks like a device-specific issue. I'll probably create a bug report.

          I am also seeing a blue check box with Vanadium but it's red with Tor browser. Using a Pixel 7 Pro. @GrapheneOS is this hardware specific?