Google Chrome 97 launches keyboard MAP API, causing controversy again: industry "opponents" are boycotting

On January 5th, Beijing time (later on January 4th, U.S. time), Google officially released the stable version of Chrome 97, and it has begun to roll out through the browser's automatic update system. It is worth noting that a keyboard API (keyboard MAP API) updated when the new version of Chrome 97 was released caused a lot of controversy.

It is reported that because the keyboard MAP API could not be used in iFrame, some previous web experiencers could not use this function, and applications such as Microsoft Office web applications could not use the API to detect the keys on the keyboard layout (the keyboard layout depends on the region or language).

The updated API of Chrome 97 version enables web applications in iFrame to use this function, that is to say, the keyboard MAP API can obtain the user's keyboard layout to further track and identify the user, which has caused a lot of controversy.

In this regard, Google officially explained the implementation of the new functions of the keyboard MAP API:

getLayoutMap(), used in combination with code, solves the problem of identifying the actual key pressed in the keyboard using different layout maps such as English and French keyboards, but since getLayoutMap() is not available in all contexts (cannot be used in iFrames) ), such as Office web applications such as Excel, Word, PowerPoint, etc., which appear as embedded experiences in Outlook Web, Teams, etc. and run in an iFrame cannot use this API. But just adding Keyboard MAP to the list of allowed properties solves the problem.

Despite Google's explanation, many browser "opponents" in the industry can't sit still and have issued statements of "boycott".

Among them, Mozilla, Apple, Brave and other browser developers have expressed concern about the matter. A key argument the companies have against browser integration is that websites could potentially use the feature for fingerprinting purposes.

In a response posted on GitHub, Apple stated that "The Keyboard MAP API exposes a high-entropy fingerprinting surface. This is unacceptable in terms of security and privacy, so Apple's WebKit team is not willing to implement the current proposal/specification. of this feature is not of interest."

Brave Software, the maker of the Brave browser, said: Brave inherits the keyboard API implemented by Chrome, but does not provide any functionality to the user (supported only by Chrome and Opera, but not actually used by any site), and the same API may be used for Fingerprint recognition expresses concern.

The WICG Keyboard Map Draft mentions that the API can be used for fingerprinting: users using uncommon ASCII layouts such as Dvorak or Colemak - users using ASCII layouts that do not match the default layout for their region.

Mozilla directly added Chrome 97's Keyboard MAP API to the list of "harmful APIs" and stressed that they would never use these APIs in the Firefox web browser.

Now that Google has announced that it will use the API in the Chrome 97 browser, but many other Chrome-based browsers have said they will not support the API, or simply disable the API, things are getting "scared".

Remember last time, Google caused controversy by introducing the idle detection API feature after the Chrome 94 update. This time, Google has again caused controversy by introducing the Keyboard MAP API in Chrome 97. We will continue to pay attention to the further development of this event. If you have relevant views on this event, please feel free to interact and communicate in the comment area!