AliExpress Leverages User Audio Systems For Fingerprinting (cybernews.com)
- Reference: 0185142168
- News link: https://yro.slashdot.org/story/26/08/25/0548233/aliexpress-leverages-user-audio-systems-for-fingerprinting
- Source link: https://cybernews.com/security/aliexpress-alibaba-audio-systems-tracking/
> The developer, "laserphile," wrote on [2]their blog that they recently ran into some weird issues with their Bluetooth headphones. They couldn't play music via their phone when, at the same time, the AliExpress website was open on their PC. The headphones, laserphile explained, support multipoint Bluetooth audio so they can be connected to the PC and phone at the same time, for instance, playing music on the phone and announcing notifications through the PC. "Shortly after loading the AliExpress homepage, audio from my phone would stop playing. Closing the AliExpress tab fixes it immediately," the developer said in the blog post.
>
> "Muting the tab/Firefox/Windows does not help, and there is no visible video, music, or other media playing on the page. This seemed suspicious enough to investigate." It turns out that Alibaba has been secretly leveraging AliExpress users' audio systems to track them and build detailed fingerprints of them. [...] The AliExpress site was using the browser's WebAudio API to run invisible sound waves at zero volume. By measuring tiny hardware differences in how each PC processed those signals, the site created a unique digital fingerprint to track devices -- without user knowledge or consent.
>
> The secret audio path froze the developer's Bluetooth connection while covertly scraping hardware memory, screen dimensions, and network data in the background. The data collection extends beyond audio. Further inspection revealed that the same scripts also measure canvas, WebGL, hardware specs, WebRTC, mouse/touch events, and automation indicators. All of these form a broad device fingerprint that is sent back to Alibaba's telemetry servers.
The simplest fix is to use a privacy-focused browser such as Firefox or Brave, which can limit or block this kind of fingerprinting. Brave goes further by randomizing fingerprint data and blocking the AliExpress tracking scripts involved.
[1] https://cybernews.com/security/aliexpress-alibaba-audio-systems-tracking/
[2] https://blog.laserphile.com/2026/08/aliexpress-webpage-keeping-multipoint.html
It seems like (Score:2)
this person just found out how browsers share data with a website, and/or how cookies work. You can tell he doesn't know what he's talking about when he suggests Firefox or Brave as "privacy-focused" browsers
Be honest (Score:2)
The only reason other sites like Amazon, Google aren't doing it is because they hadn't thought of it yet.
mic (Score:2)
So the microphone is broken on my phone. What will they ascertain from that?
Re: (Score:2)
It's played at zero volume so the mic is not used anyway. RTFS, it is instead analyzing tiny differences in the hardware, not bouncing sound out and back in.
Brave Origin (Score:2)
Use Brave Origin instead. It's all the blocking and none of the mainstream Brave bloat. Free on Linux and purchasable as a one-off elsewhere.
Re: (Score:2)
> Use Brave Origin instead. It's all the blocking and none of the mainstream Brave bloat. Free on Linux and purchasable as a one-off elsewhere.
Or simply debloat Brave...
Ancient News to privacy software (Score:1)
This was mitigated many years ago for anyone who uses privacy and anti-fingerprinting browsers or plugins. If you haven’t switched by now then this and other warnings aren’t going to persuade you anyway.
No.... (Score:5, Insightful)
No, the simplest fix is to not patronize AliExpress.
Re:No....lol (Score:2)
I was going to reply with "but I need..." and insert a ridiculous item. I then went to AliExpress for a suitable example and quickly realized it was beyond parody, and, frankly, the $0.33 fpv drones and the $0.99 "Softness Silicone Squeezer Grippers Flexible Durable Forearm Rings Hand Exerciser Easy To Clean Silicone" seem like compelling products.
Re: (Score:2)
First, I thought everyone knew about this, the same as using the HTML canvas and CSS to do fingerprinting. I'm sure they aren't the first to do it. That's one reason why audio permission has defaulted to off in my browsers for as long as I can remember.
Second, even if you for some reason trust Amazon and the like more, AliExpress is how you avoid getting shafted by middle men. 90% of the stuff on Amazon is just AliExpress resellers and a 1000% mark-up. Boycotting them is going to be very, very expensive.
Re: No.... (Score:2)
[1]obligatory xkcd [xkcd.com]
[1] https://xkcd.com/2501/
Re: (Score:2)
I've also had audio blocked in browsers since it was implemented.
Nothing more irritating than opening a page and suddenly some loud obnoxious noise blares out.
Re: (Score:2)
Which doesnt “fix” the underlying issue - the browser is leaking data about you against your knowledge and permission.
That sounds like a flaw in the browser. That should probably be fixed.