- AliExpress has been caught using silent Web Audio processing to fingerprint visitors' browsers, a technique that generates inaudible signals to measure device-specific differences.
- Researcher Matthew Callaghan discovered the tracking method when audio from his phone stopped playing over his multipoint headphones after loading the AliExpress homepage.
- Callaghan found two obfuscated scripts that rendered an audio graph acting as an oscillator, measuring inaudible signals to fingerprint browsers.
- The scripts set gain to zero but remained connected to system audio, allowing the browser to continue processing and send data to AliExpress.
- Brave has stated that it blocks the AliExpress scripts responsible for the audio-based tracking.
- Firefox implemented a fix starting in 2023, using its own math libraries to reduce entropy and stop the technique.
- Chrome is also ineffective against this technique because it ships with its own libraries, according to a Google spokesman.
- AliExpress's use of an obsolete fingerprinting method raises questions about its necessity, given it employs more than a dozen other techniques.
- The audio processing did not record people through their microphones but generated and processed an inaudible signal to measure differences in browser and device handling.
- The scripts also gathered information tied to canvas rendering, WebGL, display settings, hardware configuration, and user interactions.
- Callaghan described the whole process as a comprehensive browser and device fingerprint.
AliExpress has been caught employing silent audio processing to fingerprint users' browsers, raising significant privacy concerns. This technique, which generates inaudible sound signals, allows the site to gather unique data from visitors' devices.1
Matthew Callaghan, a researcher, discovered the tracking method when his Bluetooth headphones stopped playing audio after visiting the site. He found that the homepage created two AudioContext objects that processed a fixed audio waveform, measuring differences in browser and device handling.23
The scripts not only analyzed audio but also collected data on canvas rendering, WebGL, and user interactions.11
Brave has taken action by blocking these scripts, while Firefox implemented a fix in 2023, using unique math libraries to prevent the technique from functioning.67
Despite the outdated nature of this method, AliExpress continues to utilize it alongside over a dozen other fingerprinting techniques, including canvas rendering and WebRTC behavior.
Tom Ritter, a Firefox developer, noted that the move to constant libraries significantly reduced the effectiveness of the audio fingerprinting method.
The use of such techniques raises questions about the extent of data collection practices by online retailers like AliExpress, which may lead to increased user tracking and privacy violations.
“The audio processing does not record via microphones but measures tiny differences in how browsers handle an inaudible signal, creating a unique fingerprint. Callaghan notes the scripts appear tied to Alibaba's anti-fraud tooling, and blocking them may cause extra CAPTCHAs or login issues.”
Malwarebytes
Ars Technica
