AliExpress Leverages User Audio Systems For Fingerprinting (cybernews.com) 83
A developer says AliExpress is using the browser's WebAudio API to help fingerprint users by playing inaudible audio and measuring tiny differences in how their devices process it. CyberNews reports: The developer, "laserphile," wrote on their blog that they recently ran into some weird issues with their Bluetooth headphones. They couldn't play music via their phone when, at the same time, the AliExpress website was open on their PC. The headphones, laserphile explained, support multipoint Bluetooth audio so they can be connected to the PC and phone at the same time, for instance, playing music on the phone and announcing notifications through the PC. "Shortly after loading the AliExpress homepage, audio from my phone would stop playing. Closing the AliExpress tab fixes it immediately," the developer said in the blog post.
"Muting the tab/Firefox/Windows does not help, and there is no visible video, music, or other media playing on the page. This seemed suspicious enough to investigate." It turns out that Alibaba has been secretly leveraging AliExpress users' audio systems to track them and build detailed fingerprints of them. [...] The AliExpress site was using the browser's WebAudio API to run invisible sound waves at zero volume. By measuring tiny hardware differences in how each PC processed those signals, the site created a unique digital fingerprint to track devices -- without user knowledge or consent.
The secret audio path froze the developer's Bluetooth connection while covertly scraping hardware memory, screen dimensions, and network data in the background. The data collection extends beyond audio. Further inspection revealed that the same scripts also measure canvas, WebGL, hardware specs, WebRTC, mouse/touch events, and automation indicators. All of these form a broad device fingerprint that is sent back to Alibaba's telemetry servers. The simplest fix is to use a privacy-focused browser such as Firefox or Brave, which can limit or block this kind of fingerprinting. Brave goes further by randomizing fingerprint data and blocking the AliExpress tracking scripts involved.
"Muting the tab/Firefox/Windows does not help, and there is no visible video, music, or other media playing on the page. This seemed suspicious enough to investigate." It turns out that Alibaba has been secretly leveraging AliExpress users' audio systems to track them and build detailed fingerprints of them. [...] The AliExpress site was using the browser's WebAudio API to run invisible sound waves at zero volume. By measuring tiny hardware differences in how each PC processed those signals, the site created a unique digital fingerprint to track devices -- without user knowledge or consent.
The secret audio path froze the developer's Bluetooth connection while covertly scraping hardware memory, screen dimensions, and network data in the background. The data collection extends beyond audio. Further inspection revealed that the same scripts also measure canvas, WebGL, hardware specs, WebRTC, mouse/touch events, and automation indicators. All of these form a broad device fingerprint that is sent back to Alibaba's telemetry servers. The simplest fix is to use a privacy-focused browser such as Firefox or Brave, which can limit or block this kind of fingerprinting. Brave goes further by randomizing fingerprint data and blocking the AliExpress tracking scripts involved.
No.... (Score:5, Insightful)
Re:No....lol (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
There are no $0.33 FPV drones. That's probably a controller wrist strap. Silicone squeezers are for people who want to increase grip strength, whether they're climbers or just people with an incapacity, getting those for a dollar would be great. The stupid product names are necessary because AliExpress' search is hot garbage. And this is after they've improved it considerably! Unfortunately they haven't realized that people need to be able to search for things like fractions.
Re: (Score:2)
I like their "Super Power Violent Fan". Works great for dusting computers.
Seriously though, they made electronics hobby affordable (and a bit of a gambling - you never know if the stuff you order will work).
Re:No.... (Score:5, Insightful)
First, I thought everyone knew about this, the same as using the HTML canvas and CSS to do fingerprinting. I'm sure they aren't the first to do it. That's one reason why audio permission has defaulted to off in my browsers for as long as I can remember.
Second, even if you for some reason trust Amazon and the like more, AliExpress is how you avoid getting shafted by middle men. 90% of the stuff on Amazon is just AliExpress resellers and a 1000% mark-up. Boycotting them is going to be very, very expensive.
Re: No.... (Score:2)
Re: (Score:2)
I've also had audio blocked in browsers since it was implemented.
Nothing more irritating than opening a page and suddenly some loud obnoxious noise blares out.
Re: (Score:2)
That shit was a problem in the 90's. Who remembers the embed tag? And always some GodAwfulDisneySong.midi
It can be hard to buy things online (Score:2)
It's easy to say just go somewhere else but increasingly there are fewer and fewer somewhere else to go to. Market consolidation is a bitch and no
Re: (Score:1)
Right try visiting any large financial if you don't play nicely with shape, nudata, and friends.
Anubis is super irritating too; but the flip side is what are smaller sites supposed to do. The world collectively decided terms of service for anything not behind an authentication wall are to be freely ignored. "F*** your robots.txt" seems to be the mantra of the AI cowboys who have turned the scripting a scraping up to 11.
There "open" web won't have room for humans much longer.
Re: (Score:2)
It's easy to say just go somewhere else
I usually Just Don't buy It. Save money and stick it to the man, what's not to like.
Re: (Score:2)
Which doesnt “fix” the underlying issue - the browser is leaking data about you against your knowledge and permission.
That sounds like a flaw in the browser. That should probably be fixed.
throwing out the baby with the bathwater (Score:2)
you can't really "fix" fingerprinting unless you reduce a browser's capabilities to the point of it being practically useless (for "modern" use). blocking, hiding in the crowd, randomizing ... it's not even a cat-and-mouse game, it's like trying to put out fires with spit.
whatever you use (and privacy oriented browser set ups are a good idea for many other reasons) assume that your device is being tagged.
Re: (Score:3)
Maybe W3C or some body should issue certificates, and companies doing business with the government would have to make their websites conform to get government business ?
new old browsing (Score:4, Informative)
i would like peace on earth :-)
you can try. if you build your own browser from scratch (or alternatively use something like lynx) you could "mitigate" to the greatest extent, but subtleties in http header values and handshake and the very fact that you deny everything will make you stand out, not to mention you would likely be tagged as a bot and denied access to begin with.
feeding drooling trolls (Score:1)
you need to stop munching on this delusional war propaganda nonsense. this data is public.
reality check: russia's economy is growing despite the war and the "sanctions", even the imf projects 1,1% growth in 2026 and 2027. bank of russia is more cautious forecasting between 0% and 1%. noteworthy is that this growth happens without debt.
ukraine, however, is sadly another story. all the flamboyant pr strikes on wildberries, refineries and civilians have indeed caused damage but the biggest impact is on the rus
Re:No.... (Score:4, Interesting)
As for why Aliexpress wants this uniqueness, it's probably to do with their business model of blasting offers at people and wanting to track engagement, fraud, bots and so on.
Remote screening (Score:2)
The problem is the leak is very hard to plug. Sites legitimately need to know your screen dimensions for stuff like layout.
I've often wondered if remote screening would put an end to this.
Imagine a paid service where the company serves as your window into the internet and composes your HTML and sends it to you as an image displayed by their app. You could magnify or smallify the image as needed, and the app would send mouse and keyboard events back to the company to be forwarded on your behalf.
It's not a fully formed idea, you would also need to package and send audio, deal with credit card payments, and so on, but for people w
Re: (Score:2)
We need tighter browser discipline (Score:2)
Most sites don't actually need to know my screen size, since they render to a window and not to my full screen.
Sites can know if I support a baseline WebGL, but don't need to know about any driver version or extensions. I can grant permission to a game site that is actually using WebGL to see extensions (e.g. EXT_texture_filter_anisotropic). While hidden, the extensions should be disabled so sites can't just go around the permissions.
If a site asks for my microphone or camera, I click "no" except for the ve
Re: (Score:2)
It doesn't NEED to know any of these things. My browser knows the window (not screen) size and if your CSS is well-formed, it'll manage or maybe your page looks shit if you build it shit. It needs to know my OS only if I want a download link, not on every page I ever visit. It doesn't need graphics capabilities unless it wants to bypass the browser rendering engine, in which case it should ask for permission or fuck off.
The thing is that we give up too easily and the major browser manufacturers (one of whic
Re: (Score:2)
My browser knows the window (not screen) size
Congrats, you just broke every video player on the internet. Nothing fullscreens anymore.
It needs to know my OS only if I want a download link
You just broke layout, encryption, media delivery, fonts, you can see this in action when someone posts on Slashdot from an Apple device as Slashdot doesn't recognise that it forces UTF-8 and screws up basic text. Not everything on the internet is handled by the browser, some things interact with the OS itself.
It doesn't need graphics capabilities unless it wants to bypass the browser rendering engine, in which case it should ask for permission or fuck off.
Errr it's the browser rendering engine that actually tells the website the graphics capabilities. That one was
Re: (Score:1)
This is just nonsense. I'm assuming you just make garbage pages, which seems to be the standard these days.
Re: (Score:2)
I assume you have no idea how the modern internet functions. Its the more likely assumption.
Re: (Score:2)
I want "fuck the ad industry" mode, where the browser generates random but plausible values for every non-essential information a website requests. Different ones every 5 minutes.
Why? You'd be such an irrelevant bit of noise in the dataset.
I think that's the point. Also it puts a little bit more noise in the dataset, making it a lit bit less useful. If we all did this, there would be less profit to be made by collecting the datasets in the first place.
Re: (Score:2)
Congrats, you just broke every video player on the internet. Nothing fullscreens anymore.
Complete bullshit. Even for fullscreen video, the website doesn't need to know my screen size. It should tell the browser "here are the resolutions I can offer you" and the browser picks one of those. All the website needs to know is if I prefer 1080p or 4K. And I might pick 1080p even if my screen is 4K because, say, the hotel wifi is slow.
You just broke layout, encryption, media delivery, fonts
Complete bullshit. None of these things break if I don't tell you my OS. I've got extensions in this browser that can fake my agent string and nothing breaks. Fonts? Are
Re: (Score:2)
Sure, if you have no idea how it works you'd come to that conclusion. hint: the browser doesn't control video playback.
Re: (Score:2)
lol
Welcome to the 21st century, you might have to catch up on a few things. Start with Mozilla Media Engine and AVFoundation / WebKit Media Stack.
Your website sends me an H.264 stream (or whatever you decided you'll use). It doesn't need to know shit about my graphics hardware.
Re: (Score:2)
It's not about browsers being "complicit" and all about browsers trying to deliver a modern experience which is capable of supporting things like accessibility, audio, video, camera, microphone, serial, graphics and every thing else.
I think there are settings and switches that browsers could do to mitigate some of this risk,
Re: (Score:2)
Your browser leaks uniqueness out of every orifice and every single one of those things has a legit use case.
Sure, the same way that putting a finger into another man's ass has a legit use case (prostate examination) - but that doesn't mean I want every man to do that to me all the time.
The point is that tech companies are exploiting the legit use cases by abusing them when you're not in that use case. Basically, they think they can finger up your ass whenever they want, because once a few years ago you consented to a doctor to give you an exam and maybe you will do that again in the future.
which is capable of
I don't mind it being c
Re: (Score:2)
Re: (Score:2)
Sites legitimately need to know your screen dimensions for stuff like layout. They legitimately need to know your OS for recommending the right download links. They legitimately need to know your graphics capabilities to render the right thing.
No. They don't. It is more convenient for them to get this information, but they do NOT legitimately need to know. I am perfectly capable of resizing the window. I am perfectly capable of choosing the correct download link for my operating system. Websites do not "need" to display graphics that are so far out of the norm that a standard graphics card couldn't draw them.
"I" am in control, not "them". Do NOT attempt to take control away from me.
Re: (Score:3)
Most browsers have fixed it. Firefox, for example, uses software libraries that implement high precision math so every Firefox user ends up looking the same because the fingerprint you get comes back the same.
Safari does something different, and it adds random noise to the audio waveform so the same browser wil
Re: (Score:2)
No, the problem is that we let webpages access bluetooth in the first place. Google added this feature to the web so that they could do fingerprinting with it. This is the entirely predictable result.
It seems like (Score:2)
Be honest (Score:2)
The only reason other sites like Amazon, Google aren't doing it is because they hadn't thought of it yet.
that silence is way too noisy (Score:2)
The only reason other sites like Amazon, Google aren't doing it is because they hadn't thought of it yet.
i'd say it's not even a very good technique since it is so ... noisy.
mic (Score:2)
Re: (Score:3)
It's played at zero volume so the mic is not used anyway. RTFS, it is instead analyzing tiny differences in the hardware, not bouncing sound out and back in.
Re: (Score:2)
:frowns:
I thought Chrome devs went hard on fuzzing API's after the timing attacks went big ... circa 2020.
Back to the drawing board.
Re: (Score:2)
Brave Origin (Score:2)
Use Brave Origin instead. It's all the blocking and none of the mainstream Brave bloat. Free on Linux and purchasable as a one-off elsewhere.
Re: (Score:2)
Use Brave Origin instead. It's all the blocking and none of the mainstream Brave bloat. Free on Linux and purchasable as a one-off elsewhere.
Or simply debloat Brave...
Re: Brave Origin (Score:2)
You can't. The bloat is baked in.
Ancient News to privacy software (Score:1)
What processing? (Score:2)
Re: (Score:2)
User tracking should be forbidden by law (Score:1)
If you use Firefox in strict mode and visit the Amazon login page, you see a warning that it attempts Canvas fingerprinting. Even StackOverflow had ads that were using audio fingerprinting. When someone complained on the meta site, their reaction was "Don't worry they are not playing or recording anything, it is just a safety feature to detect your browser" (or something like that). For some reason webdevs seem to think it is acceptable to spy on users.
Unpopular Opinion-whatâ(TM)s the big deal? (Score:2)
Everyone is known and traced today by multiple actors using multiple technologies. The only way to go off grid is to live off mushrooms in a cave, and maybe not even then. Better practice to hide is discipline in activity, behaving almost but not quite perfectly normal.
Re: (Score:2)
Maybe some self-hosted go-in-between that deals with all the tracking quietly and efficiently. After all that's what machines are good at.
Re: (Score:2)
Saying you need no privacy because you have nothing to hide is like saying you need no freedom of speech because you have nothing to say.
Re: Unpopular Opinion-whatâ(TM)s the big deal (Score:2)
i said nothing of the sort, you ignorant clod!
I said it is pointless to try to hide using technology, because you will fail. Your (not you personally, necessarily, mind you) very attempt to mask your fingerprint is a fingerprint. If you desire privacy, the only way to achieve it is by acting almost, but not quite, perfectly normal.
Re: (Score:2)
- sheep being sheep.
If you buy from AliExpress (Score:4, Informative)
Then you deserve whatever happens to you.
Don't patronize that filth.
Re: (Score:2)
AliExpress is an intermediary. And it allows me to buy the same stuff I would buy locally, just a lot cheaper and with reasonable shipping fees.
You you think buying the same things at artificially inflated prices is somehow "virtuous", you need to have your head examined.
Re: (Score:2)
Then you deserve whatever happens to you.
You get what you order? I'm curious what is is you're going for here. Not everything on that site is shit, and even if it were, sometimes low price shit is what you need, it's why dollar stores exist.
Re: (Score:2)
Then you deserve whatever happens to you.
I agree: I deserve to get the lowest prices on the same Chinese shit for sale everywhere. I deserve to have low-effort returns even of the cheapest merchandise, where they generally tell me I can keep both pieces instead of sending them back. I deserve to be able to purchase items nobody is bothering to list on other sites because they aren't popular.
Tons of the shit I can see from where I'm sitting came from AliExpress. I could have bought it somewhere else for more, but that would be really fucking stupid
"leverages" (Score:2)
"leverages user audio systems"....what an interesting way to spell "spying".
I wish my browser didn't rat on me (Score:2)
Why is it even possible for a web site to detect when the window has lost focus? They only do abusive things with that information, I should be able to turn that off.
Re: (Score:2)
That explains why they always have me slide (Score:3)
And make some stupid claim about some "anomaly". The "anomaly" is that probably that I use AliExpress only on a Linux machine with no audio in the Kernel.
Re: (Score:2)
Re: (Score:2)
Why would you then continue and support a clearly broken website by giving them any money? Any site that has a gatekeeper may get a visit but will never get my money.
Yeah! You should shop with Amazon or eBay instead and then you can buy... *checks notes* exactly the same thing, sourced from the same place, only more expensive because someone else made a profit clicking buttons to drop ship it to you.
Re: (Score:2)
Re: (Score:2)
I don't buy drop shipped junk. If you know what you are doing you can still filter that stuff out.
Why would I filter out the items I'm actually trying to purchase?
But hey if you are so bad off you can't support local sellers, well, sorry.
They are selling the same shit! The only difference is that they shipped it to themselves and now want me to pay extra. It's fucking 2026, my guy.
Though actually, I lied for effect: The actual difference is local sellers don't have what I want.
Re: (Score:2)
The actual difference is local sellers don't have what I want.
Exactly. If I could get the stuff I want here, at tolerable prices, I would buy locally. But I cannot or I pay 10x more. And then sometimes wait longer because they order the stuff in China. I can do that myself better and faster via AliExpress.
Re: (Score:2)
The "local sellers" charge me $50 for 10 carbide mills and they only carry a small selection. The same (!) item off AliExpress costs me $10 with shipping and I can get exactly what I want.
You were saying?
Re: (Score:2)
Exactly. Only that Amazon does not have many of the things and charges much more for shipping. The whole argument is stupid. AliExpress has some problems but it is just a trading-platform and not who I do business with in the end. As long as I get reasonable quality items (some buyer skill and insight involved) at reasonable prices and conditions and there is no better source, I am happy to buy from vendors that use AliExpress.
Re: (Score:2)
I am not giving a "website" money. I am buying stuff on a trading platform. I guess that idea is too complex for you.
Re: That explains why they always have me slide (Score:2)
They do it to me while I'm trying to work around their shitty search and mediocre listings pages, like clicking back and forth between the different items listed on a page comparing them. Basically anything that could be bot activity, but it's really because their site sucks. Still, it's been improving consistently if slowly.
Re: (Score:2)
Re: (Score:2)
I can do it, but it's irritating. The most they have ever had me verify I'm human was three times in one day. They used to use a lot of irritating minigame type captchas like slide the puzzle piece, but now they are using mostly just a slider — at least visibly. I have firefox set to ask before allowing a site audio, and it asked me if AliExpress could have it and I told it no. They seem to have finally given up on hassling me for notifications, so right now I am relatively pleased with them except fo
Re: (Score:2)
Yep, their site is really annoying and search is exceptionally bad. But they only have me slide on checkout, so that is tolerable if dementedly stupid and the vendors on their site are generally a lot better than the site.