Microphone privacy concern

pparent

Hello everyone,

I realized a privacy concern about microphone that concerned unsuspended whatsweb, and whatsnew, but that could possibly concern many other webapps, or even regular apps.

The concern is that when running those webapps with microphone permission allowed and unsuspended to get notifications, then the subjacent website (in that case whatsapp) can effectively spy on your microphone at any moment, while your phone is suspended and the screen turned off, without you even being notified about that.

I'm going to see what I can do, on the application side, but it's not easy as it seems chromium engine does not allow easily to switch on and off the microphone in the webview, whether we are using electron or on Qtwebengine. You can chose to give or not the permission for the microphone, but when it's given it's hard to revoke without reloading the whole application.

Here are some possible features that could be useful, on the side of the OS:

Add an icon to the systray when an Application is recording the microphone as KDE does.
Add an option to disable the microphone for all apps (except maybe the phone app) when the phone is suspended.
Or Even add an option to automatically diable the microphone for apps that are not in foreground (maybe except if they have a background microphone authorization)
Add some tools for the apps themself to be able to know wether or not they are recording, and enable/disable or mute/unmute the microphone for themself a the level of pulseaudio. This should be accessible even for a confined app, and through shell command so that is universal.

Any thought on that?

pparent

I really think that ideally there should be two distinct permissions for the apps:

Foreground Microphone: The app can only access the microphone when it is foreground, that would be sufficient for most apps.
Background Microphone: That would be usefull for only a small minority of very trusted apps , like phone apps that may need to maintain a call while the phone is suspended.

But it's very different to give the opportunity to spy on the microphone at any moment which is a critical permission, and to allow the app to use the microphone while on foreground which is what most app would need and is way less critical.