Citiverse è uno spazio aperto a tutte le comunità. Se vuoi aprire un gruppo locale o una sezione per la tua organizzazione, puoi contattare gli amministratori: pagina dei contatti.
AliExpress was silently running audio in your browser to fingerprint and track your device
-
A hot potato: As cookies become a less reliable way to track people online, AliExpress may be showing how far companies will go to fill that gap. Researchers found code on the site's homepage that ran silent audio processes in the browser. Tied to Alibaba's security systems, the scripts tap a device's own audio hardware to generate a signal and measure the tiny, device-specific ways it comes back – producing something close to a fingerprint that doesn't need a single cookie to work. It's the kind of tracking a user would likely never notice.
The issue only surfaced after a developer had trouble using multipoint Bluetooth headphones while an AliExpress tab was open: the headphones wouldn't switch properly from the computer to a phone. Once the tab was closed, the problem disappeared.
Digging into the site's code, the developer found it was using the Web Audio API to build audio-processing graphs set to zero volume. The process produced no audible sound, but it still connected to the computer's audio system, keeping the audio path active in the background, which appears to be what interfered with the headphones' ability to switch devices.
This wasn't the kind of audio activity tied to a normal media player. Because the processing graph ran at zero gain and connected directly to the system's audio output, muting the browser tab did nothing to stop it: the browser kept processing the signal even though there was nothing to hear.
-
A hot potato: As cookies become a less reliable way to track people online, AliExpress may be showing how far companies will go to fill that gap. Researchers found code on the site's homepage that ran silent audio processes in the browser. Tied to Alibaba's security systems, the scripts tap a device's own audio hardware to generate a signal and measure the tiny, device-specific ways it comes back – producing something close to a fingerprint that doesn't need a single cookie to work. It's the kind of tracking a user would likely never notice.
The issue only surfaced after a developer had trouble using multipoint Bluetooth headphones while an AliExpress tab was open: the headphones wouldn't switch properly from the computer to a phone. Once the tab was closed, the problem disappeared.
Digging into the site's code, the developer found it was using the Web Audio API to build audio-processing graphs set to zero volume. The process produced no audible sound, but it still connected to the computer's audio system, keeping the audio path active in the background, which appears to be what interfered with the headphones' ability to switch devices.
This wasn't the kind of audio activity tied to a normal media player. Because the processing graph ran at zero gain and connected directly to the system's audio output, muting the browser tab did nothing to stop it: the browser kept processing the signal even though there was nothing to hear.
That’s a fairly common fingerprinting technique. A lot of sites use this and similar techniques (e.g. GPU fingerprinting, font fingerprinting, etc.) See https://developer.mozilla.org/en-US/docs/Glossary/Fingerprinting
Or try https://amiunique.org/ for a live illustration how that works.
-
A hot potato: As cookies become a less reliable way to track people online, AliExpress may be showing how far companies will go to fill that gap. Researchers found code on the site's homepage that ran silent audio processes in the browser. Tied to Alibaba's security systems, the scripts tap a device's own audio hardware to generate a signal and measure the tiny, device-specific ways it comes back – producing something close to a fingerprint that doesn't need a single cookie to work. It's the kind of tracking a user would likely never notice.
The issue only surfaced after a developer had trouble using multipoint Bluetooth headphones while an AliExpress tab was open: the headphones wouldn't switch properly from the computer to a phone. Once the tab was closed, the problem disappeared.
Digging into the site's code, the developer found it was using the Web Audio API to build audio-processing graphs set to zero volume. The process produced no audible sound, but it still connected to the computer's audio system, keeping the audio path active in the background, which appears to be what interfered with the headphones' ability to switch devices.
This wasn't the kind of audio activity tied to a normal media player. Because the processing graph ran at zero gain and connected directly to the system's audio output, muting the browser tab did nothing to stop it: the browser kept processing the signal even though there was nothing to hear.
While I'm sure companies would love to do this, won't they need microphone permissions from the browser to get the reflected sound?
-
A hot potato: As cookies become a less reliable way to track people online, AliExpress may be showing how far companies will go to fill that gap. Researchers found code on the site's homepage that ran silent audio processes in the browser. Tied to Alibaba's security systems, the scripts tap a device's own audio hardware to generate a signal and measure the tiny, device-specific ways it comes back – producing something close to a fingerprint that doesn't need a single cookie to work. It's the kind of tracking a user would likely never notice.
The issue only surfaced after a developer had trouble using multipoint Bluetooth headphones while an AliExpress tab was open: the headphones wouldn't switch properly from the computer to a phone. Once the tab was closed, the problem disappeared.
Digging into the site's code, the developer found it was using the Web Audio API to build audio-processing graphs set to zero volume. The process produced no audible sound, but it still connected to the computer's audio system, keeping the audio path active in the background, which appears to be what interfered with the headphones' ability to switch devices.
This wasn't the kind of audio activity tied to a normal media player. Because the processing graph ran at zero gain and connected directly to the system's audio output, muting the browser tab did nothing to stop it: the browser kept processing the signal even though there was nothing to hear.
For what it's worth, the European tracking law doesn't give a shit whether you use cookies, localstorage, fingerprinting or pigeons to track people. If you do not consent, it's not allowed.
Then again, good luck enforcing China to comply.
-
While I'm sure companies would love to do this, won't they need microphone permissions from the browser to get the reflected sound?
If I understand checkt, hey're not actually capturing the sound, just measuring the delays that hardware- and software specific implementations introduce. With the Web audio api, you can connect all sorts of nodes to one another - audio file input, to a left/right splitter, to a frequency analyser, to a joiner, etc. It can get quite complex.
Like you said, actually needing mic input would be too obvious and the -
For what it's worth, the European tracking law doesn't give a shit whether you use cookies, localstorage, fingerprinting or pigeons to track people. If you do not consent, it's not allowed.
Then again, good luck enforcing China to comply.
It's irrelevant if the provider is from the EU or not, all of these are forced to fullfit the privacy law if they want to operate in the EU, even Microsoft itself: big difference between Microsoft US, full of trackers and even keyloggers (Towerdata), and Microsoft DE with 2 cookies.
Ciao! Sembra che tu sia interessato a questa conversazione, ma non hai ancora un account.
Stanco di dover scorrere gli stessi post a ogni visita? Quando registri un account, tornerai sempre esattamente dove eri rimasto e potrai scegliere di essere avvisato delle nuove risposte (tramite email o notifica push). Potrai anche salvare segnalibri e votare i post per mostrare il tuo apprezzamento agli altri membri della comunità.
Con il tuo contributo, questo post potrebbe essere ancora migliore 💗
Registrati Accedi
Citiverse è un progetto che si basa su NodeBB ed è federato! | Categorie federate | Chat | 📱 Installa web app o APK | 🧡 Donazioni | Privacy Policy