Forgot your password?
Close
typodupeerror
Privacy

AliExpress Leverages User Audio Systems For Fingerprinting (cybernews.com) 68

Posted by BeauHD from the track-and-shop dept.
A developer says AliExpress is using the browser's WebAudio API to help fingerprint users by playing inaudible audio and measuring tiny differences in how their devices process it. CyberNews reports: The developer, "laserphile," wrote on their blog that they recently ran into some weird issues with their Bluetooth headphones. They couldn't play music via their phone when, at the same time, the AliExpress website was open on their PC. The headphones, laserphile explained, support multipoint Bluetooth audio so they can be connected to the PC and phone at the same time, for instance, playing music on the phone and announcing notifications through the PC. "Shortly after loading the AliExpress homepage, audio from my phone would stop playing. Closing the AliExpress tab fixes it immediately," the developer said in the blog post.

"Muting the tab/Firefox/Windows does not help, and there is no visible video, music, or other media playing on the page. This seemed suspicious enough to investigate." It turns out that Alibaba has been secretly leveraging AliExpress users' audio systems to track them and build detailed fingerprints of them. [...] The AliExpress site was using the browser's WebAudio API to run invisible sound waves at zero volume. By measuring tiny hardware differences in how each PC processed those signals, the site created a unique digital fingerprint to track devices -- without user knowledge or consent.

The secret audio path froze the developer's Bluetooth connection while covertly scraping hardware memory, screen dimensions, and network data in the background. The data collection extends beyond audio. Further inspection revealed that the same scripts also measure canvas, WebGL, hardware specs, WebRTC, mouse/touch events, and automation indicators. All of these form a broad device fingerprint that is sent back to Alibaba's telemetry servers. The simplest fix is to use a privacy-focused browser such as Firefox or Brave, which can limit or block this kind of fingerprinting. Brave goes further by randomizing fingerprint data and blocking the AliExpress tracking scripts involved.

AliExpress Leverages User Audio Systems For Fingerprinting More | Reply

AliExpress Leverages User Audio Systems For Fingerprinting

Comments Filter:

  • No.... (Score:5, Insightful)

    by YetanotherUID ( 4004939 ) on Tuesday August 25, 2026 @03:16AM (#66305746)
    No, the simplest fix is to not patronize AliExpress.

    • Re:No....lol (Score:4, Funny)

      by fishfrys ( 720495 ) on Tuesday August 25, 2026 @03:34AM (#66305770)
      I was going to reply with "but I need..." and insert a ridiculous item. I then went to AliExpress for a suitable example and quickly realized it was beyond parody, and, frankly, the $0.33 fpv drones and the $0.99 "Softness Silicone Squeezer Grippers Flexible Durable Forearm Rings Hand Exerciser Easy To Clean Silicone" seem like compelling products.
      • I'm really only interested in Soft Silicone Hand Grippers for Muscle Relaxation. Any chance they had some of those?

      • There are no $0.33 FPV drones. That's probably a controller wrist strap. Silicone squeezers are for people who want to increase grip strength, whether they're climbers or just people with an incapacity, getting those for a dollar would be great. The stupid product names are necessary because AliExpress' search is hot garbage. And this is after they've improved it considerably! Unfortunately they haven't realized that people need to be able to search for things like fractions.

    • Re:No.... (Score:5, Insightful)

      by AmiMoJo ( 196126 ) on Tuesday August 25, 2026 @04:04AM (#66305790) Homepage Journal

      First, I thought everyone knew about this, the same as using the HTML canvas and CSS to do fingerprinting. I'm sure they aren't the first to do it. That's one reason why audio permission has defaulted to off in my browsers for as long as I can remember.

      Second, even if you for some reason trust Amazon and the like more, AliExpress is how you avoid getting shafted by middle men. 90% of the stuff on Amazon is just AliExpress resellers and a 1000% mark-up. Boycotting them is going to be very, very expensive.

      • Re: (Score:2)

        by Bert64 ( 520050 )

        I've also had audio blocked in browsers since it was implemented.
        Nothing more irritating than opening a page and suddenly some loud obnoxious noise blares out.

        • Re: (Score:2)

          by Tarlus ( 1000874 )

          That shit was a problem in the 90's. Who remembers the embed tag? And always some GodAwfulDisneySong.midi

      • If you don't let them track you. Big sites use fingerprinting as part of their fraud protection systems and they will just flat out block you if you trigger one of them. For a while I couldn't buy anything on the PlayStation Network because Sony decided I must be a thief. The customer service can't be bothered because there's too many scammers hitting them up.

        It's easy to say just go somewhere else but increasingly there are fewer and fewer somewhere else to go to. Market consolidation is a bitch and no

        • Re: (Score:1)

          by DarkOx ( 621550 )

          Right try visiting any large financial if you don't play nicely with shape, nudata, and friends.

          Anubis is super irritating too; but the flip side is what are smaller sites supposed to do. The world collectively decided terms of service for anything not behind an authentication wall are to be freely ignored. "F*** your robots.txt" seems to be the mantra of the AI cowboys who have turned the scripting a scraping up to 11.

          There "open" web won't have room for humans much longer.

    • Which doesnt “fix” the underlying issue - the browser is leaking data about you against your knowledge and permission.

      That sounds like a flaw in the browser. That should probably be fixed.

      • you can't really "fix" fingerprinting unless you reduce a browser's capabilities to the point of it being practically useless (for "modern" use). blocking, hiding in the crowd, randomizing ... it's not even a cat-and-mouse game, it's like trying to put out fires with spit.

        whatever you use (and privacy oriented browser set ups are a good idea for many other reasons) assume that your device is being tagged.

        • I would like my browser to not be for modern use but for showing text and images with HTML, and for websites to work like that when the user desires it. No cookies, no local storage, no audio tricks, etc.

          Maybe W3C or some body should issue certificates, and companies doing business with the government would have to make their websites conform to get government business ?

          • new old browsing (Score:4, Informative)

            by znrt ( 2424692 ) on Tuesday August 25, 2026 @08:10AM (#66305942)

            i would like peace on earth :-)

            you can try. if you build your own browser from scratch (or alternatively use something like lynx) you could "mitigate" to the greatest extent, but subtleties in http header values and handshake and the very fact that you deny everything will make you stand out, not to mention you would likely be tagged as a bot and denied access to begin with.

      • Re:No.... (Score:4, Interesting)

        by DrXym ( 126579 ) on Tuesday August 25, 2026 @08:37AM (#66305966)
        The problem is the leak is very hard to plug. Sites legitimately need to know your screen dimensions for stuff like layout. They legitimately need to know your OS for recommending the right download links. They legitimately need to know your graphics capabilities to render the right thing. And so on. The problem is that in aggregate all these things basically make your machine and your browser unique and distinguishable from another.

        As for why Aliexpress wants this uniqueness, it's probably to do with their business model of blasting offers at people and wanting to track engagement, fraud, bots and so on.

        • The problem is the leak is very hard to plug. Sites legitimately need to know your screen dimensions for stuff like layout.

          I've often wondered if remote screening would put an end to this.

          Imagine a paid service where the company serves as your window into the internet and composes your HTML and sends it to you as an image displayed by their app. You could magnify or smallify the image as needed, and the app would send mouse and keyboard events back to the company to be forwarded on your behalf.

          It's not a fully formed idea, you would also need to package and send audio, deal with credit card payments, and so on, but for people w

          • Sounds like a VDI. A cloud hosted VM that you access through a browser and run another browser in. Thy can fingerprint the VM, but not you. And you can often screw with them further by resizing your local browser window to resize the desktop.

        • Most sites don't actually need to know my screen size, since they render to a window and not to my full screen.

          Sites can know if I support a baseline WebGL, but don't need to know about any driver version or extensions. I can grant permission to a game site that is actually using WebGL to see extensions (e.g. EXT_texture_filter_anisotropic). While hidden, the extensions should be disabled so sites can't just go around the permissions.

          If a site asks for my microphone or camera, I click "no" except for the ve

        • Re: (Score:2)

          by Tom ( 822 )

          It doesn't NEED to know any of these things. My browser knows the window (not screen) size and if your CSS is well-formed, it'll manage or maybe your page looks shit if you build it shit. It needs to know my OS only if I want a download link, not on every page I ever visit. It doesn't need graphics capabilities unless it wants to bypass the browser rendering engine, in which case it should ask for permission or fuck off.

          The thing is that we give up too easily and the major browser manufacturers (one of whic

          • My browser knows the window (not screen) size

            Congrats, you just broke every video player on the internet. Nothing fullscreens anymore.

            It needs to know my OS only if I want a download link

            You just broke layout, encryption, media delivery, fonts, you can see this in action when someone posts on Slashdot from an Apple device as Slashdot doesn't recognise that it forces UTF-8 and screws up basic text. Not everything on the internet is handled by the browser, some things interact with the OS itself.

            It doesn't need graphics capabilities unless it wants to bypass the browser rendering engine, in which case it should ask for permission or fuck off.

            Errr it's the browser rendering engine that actually tells the website the graphics capabilities. That one was

            • This is just nonsense. I'm assuming you just make garbage pages, which seems to be the standard these days.

          • Re: (Score:2)

            by DrXym ( 126579 )
            Your browser leaks uniqueness out of every orifice and every single one of those things has a legit use case. And in aggregate they supply enough bits to be unique to your computer.

            It's not about browsers being "complicit" and all about browsers trying to deliver a modern experience which is capable of supporting things like accessibility, audio, video, camera, microphone, serial, graphics and every thing else.

            I think there are settings and switches that browsers could do to mitigate some of this risk,

        • Modern sites render like an app using scripts, most of that info is handled by the scripting client-side; there is no reason to return most of the data home except for data collection and fingerprinting.

      • Re: (Score:3)

        by tlhIngan ( 30335 )

        Which doesnt âoefixâ the underlying issue - the browser is leaking data about you against your knowledge and permission.

        That sounds like a flaw in the browser. That should probably be fixed.

        Most browsers have fixed it. Firefox, for example, uses software libraries that implement high precision math so every Firefox user ends up looking the same because the fingerprint you get comes back the same.

        Safari does something different, and it adds random noise to the audio waveform so the same browser wil

    • No, the problem is that we let webpages access bluetooth in the first place. Google added this feature to the web so that they could do fingerprinting with it. This is the entirely predictable result.

  • this person just found out how browsers share data with a website, and/or how cookies work. You can tell he doesn't know what he's talking about when he suggests Firefox or Brave as "privacy-focused" browsers

  • The only reason other sites like Amazon, Google aren't doing it is because they hadn't thought of it yet.

  • So the microphone is broken on my phone. What will they ascertain from that?

    • It's played at zero volume so the mic is not used anyway. RTFS, it is instead analyzing tiny differences in the hardware, not bouncing sound out and back in.

      • :frowns:

        I thought Chrome devs went hard on fuzzing API's after the timing attacks went big ... circa 2020.

        Back to the drawing board.

      • 'Tiny Differences' doesn't cut it here on Slashdot. What exactly are they analyzing when audio only goes out? It's essentially 'play this wav' and the API driver says 'ok, done.' How long it takes to get a successful return through the API? Seems fairly unreliable.

  • Use Brave Origin instead. It's all the blocking and none of the mainstream Brave bloat. Free on Linux and purchasable as a one-off elsewhere.

  • This was mitigated many years ago for anyone who uses privacy and anti-fingerprinting browsers or plugins. If you haven’t switched by now then this and other warnings aren’t going to persuade you anyway.
  • âoeAudio fingerprinting works because small differences in browser versions, operating systems, audio libraries, and hardware can produce slightly different results...â. And I am left wondering, what results? What can the web site read back - is it recording the output back through audio input? Are there other arithmetic reaults that can be read back? Timing? Why the article does not ANSWER THE OBVIOUS QUESTIONS?

  • Everyone is known and traced today by multiple actors using multiple technologies. The only way to go off grid is to live off mushrooms in a cave, and maybe not even then. Better practice to hide is discipline in activity, behaving almost but not quite perfectly normal.

    • Maybe some self-hosted go-in-between that deals with all the tracking quietly and efficiently. After all that's what machines are good at.

    • Re: (Score:2)

      by allo ( 1728082 )

      Saying you need no privacy because you have nothing to hide is like saying you need no freedom of speech because you have nothing to say.

      • i said nothing of the sort, you ignorant clod!

        I said it is pointless to try to hide using technology, because you will fail. Your (not you personally, necessarily, mind you) very attempt to mask your fingerprint is a fingerprint. If you desire privacy, the only way to achieve it is by acting almost, but not quite, perfectly normal.

    • Yours is the exact thinking that got us into this mess. THANKS!

      - sheep being sheep.

  • If you buy from AliExpress (Score:3)

    by DewDude ( 537374 ) on Tuesday August 25, 2026 @09:47AM (#66306050) Homepage

    Then you deserve whatever happens to you.

    Don't patronize that filth.

    • Re: (Score:2)

      by gweihir ( 88907 )

      AliExpress is an intermediary. And it allows me to buy the same stuff I would buy locally, just a lot cheaper and with reasonable shipping fees.

      You you think buying the same things at artificially inflated prices is somehow "virtuous", you need to have your head examined.

    • Then you deserve whatever happens to you.

      You get what you order? I'm curious what is is you're going for here. Not everything on that site is shit, and even if it were, sometimes low price shit is what you need, it's why dollar stores exist.

    • Then you deserve whatever happens to you.

      I agree: I deserve to get the lowest prices on the same Chinese shit for sale everywhere. I deserve to have low-effort returns even of the cheapest merchandise, where they generally tell me I can keep both pieces instead of sending them back. I deserve to be able to purchase items nobody is bothering to list on other sites because they aren't popular.

      Tons of the shit I can see from where I'm sitting came from AliExpress. I could have bought it somewhere else for more, but that would be really fucking stupid

  • "leverages user audio systems"....what an interesting way to spell "spying".

  • Why is it even possible for a web site to detect when the window has lost focus? They only do abusive things with that information, I should be able to turn that off.

  • And make some stupid claim about some "anomaly". The "anomaly" is that probably that I use AliExpress only on a Linux machine with no audio in the Kernel.

    • Why would you then continue and support a clearly broken website by giving them any money? Any site that has a gatekeeper may get a visit but will never get my money.

      • Why would you then continue and support a clearly broken website by giving them any money? Any site that has a gatekeeper may get a visit but will never get my money.

        Yeah! You should shop with Amazon or eBay instead and then you can buy... *checks notes* exactly the same thing, sourced from the same place, only more expensive because someone else made a profit clicking buttons to drop ship it to you.

        • I don't buy drop shipped junk. If you know what you are doing you can still filter that stuff out. But hey if you are so bad off you can't support local sellers, well, sorry.

    • They do it to me while I'm trying to work around their shitty search and mediocre listings pages, like clicking back and forth between the different items listed on a page comparing them. Basically anything that could be bot activity, but it's really because their site sucks. Still, it's been improving consistently if slowly.

      • That's why they invented browser tabs, open each product in a new tab and compare that way. If a site doesn't allow that, it's a bad site to support.

        • I can do it, but it's irritating. The most they have ever had me verify I'm human was three times in one day. They used to use a lot of irritating minigame type captchas like slide the puzzle piece, but now they are using mostly just a slider — at least visibly. I have firefox set to ask before allowing a site audio, and it asked me if AliExpress could have it and I told it no. They seem to have finally given up on hassling me for notifications, so right now I am relatively pleased with them except fo

Slashdot Top Deals

For every complex problem, there is a solution that is simple, neat, and wrong. -- H. L. Mencken

Close