I can tell you feel strongly about this. :-)

Although there is some potential for abuse, there are legitimate use cases and I think it should remain in the platform. However, it sounds like we might want to investigate potentially reigning it in in some cases--I believe I saw discussion elsewhere about preventing it in iFrames.

+Owen, can you route to the right place?

Sorry for going overboard here, it's just that in many thousands of hours using the mobile web, the only cases I've seen of this API are abusive ads. I'd love to know what those legitimate use cases are, and how this is actually being used in the wild. Is there any way we can get data on that?

On the other hand, maybe we could use this API as a signal that a site is potentially abusive, so in that sense it might be useful to keep it.

I'll try to dig up some cases of the ads I'm talking about - they are sometimes tricky to find in the wild unless you hit very shady websites.

Oh, it wasn't that hard to find a case. I went to pagalworld.co (a very popular Indian music and video site) and upon clicking around on some ads there, I got this one:

http://go.mobisynergy.com/?utm_term=20103679069&clickverify=1&utm_content=e…8fcddfcfd598cda696a49d8c88b88d8689bc8db2ddc5dddab7c1dbeeeeeee0e0eae88db214

which causes the phone to vibrate and redirects to a dodgy "Jackpot" site. If you stop the redirect from happening you will feel the vibration happening continuously on the original page.

Also see  crbug.com/625044  which applies only to cross-origin iframes.

Kenji: I like the idea in  crbug.com/625044  very much and it may be a good place to start. However, most of the vibrate calls I've run into aren't from cross-origin iframes (or iframes at all), they are from top-level pages that attempt to mislead the user into downloading malware. Do you have a sense of how much the cross-origin iframe intervention would impact the overall abusiveness of vibrate?

Thanks for filing the issue. This is definitely a huge annoyance and we have specific plans in motion to prevent it. 

Specifically, we're first going to disable the use of vibrate from cross-origin iframes and then disable the usage of vibrate for the first 30 seconds or so when a user lands on the site. The former should prevent any issues with embedded ads, and the latter with full page malicious sites.

Assigning to Emily - I've seen this topic come up in many different issues and threads now... I wonder if we could help this by making a centralized doc or issue about this that we could point them all to, so as to provide a canonical source of information and avoid repeating discussions?

Also -komoroske now we have the issue triaged

Sweet, thanks a bunch Owen and glad this is getting some attention. Perhaps you need to start Project Good Vibrations? :-)

Created an overall bug to track this!