I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days.
Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content...
Now I wonder, does this also allow websites to continue running in the background on mobile browsers? Playing media is one of the very few things that can convince iOS Safari to keep a tab running indefinitely, in my experience.
Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.
I wonder if it is something firefox and chrome devs need to look at because if it is accessing the audio device surely it should be notified to the user.
It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period.
Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.
The speaker icon would be handy but I think that it depends from both the good will of Firefox and the installed add ons. Of course if an add on blocks the audio file there is no need to display the speaker icon for that file.
To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my Android phone. It shows a number of sites. Nothing in first party and these that I must fully enable to make the site work (css, image, script, xhr)
* aliexpress.com
* ase.aliexpress.com
* it.aliexpress.com (my country two letters domain)
* umdc-global.aliexpress.com
* aidcgroup.net
* ase.aidcgroup.net
* 67372.ase.aidcgroup.net
* alibaba-inc.com
* epss.alibaba-inc.com
* alicdn.com
* ae01.alicdn.com
* assets.alicdn.com
* aliexpress-media.com
* ae-pic-a1.aliexpress-media.com
* assets.aliexpress-media.com
* aliyun.com
* acjs.aliyun.com
Scary list, right? According to google aidcroup is
> Alibaba International is committed to the protection of intellectual property rights. Right holders and their agents can enforce intellectual property ...
Let me add a /s to the last line
There are two more sites that I can completely block
* googlesyndication.com
* pagead2.googlesyndication.com
so even Alibaba runs ads on Google.
I did not instrument the browser like the author of the post did, so I don't know where the audio comes from. There is nothing listed in the media column of uMatrix. This does not mean that the post is inaccurate. It could be that the browser gets the audio stream from a request in one of the other categories.
Probably the audio file is coming from one of the unblocked requests but my Debian laptop does not pair with my Bluetooth earpieces so I can't test it.
I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue.
@FireFoxDudes You need to be addressing fingerprinting
With my previous hearing aid I noticed that visiting a wide variety of web sites would cause a change in the amplification of environmental noise. I always assumed it was doing something with Bluetooth, and probably not for a good reason. This is with an iPhone 13 and one Kirkland/phonak hearing aid.
I haven’t noticed this recently, but I also now have two newer Phonak hearing aids and a few iOS updates have happened. Maybe the silent Bluetooth shenanigans are less disruptive to my new aids or the programming is different. Surely shenanigans continue.
It's the Bluetooth; when Bluetooth connects most hearing aids reduce the environmental volume slightly so you can hear the streaming content. Some app has started to play audio (perhaps silently). I notice it on some websites.
How much HAs reduce environmental sounds when streaming is configurable by the way, but only by the audiologist if you don't have your own programmer. I don't like the effect and prefer to just turn down the volume manually.
I wear Phonak CI processors. It's not just you. I've also experienced the volume drop on a few sites and apps. The Amazon iOS app does this. Each time I leave the app, ambient audio returns to normal.
I noticed my MBP had a periodic stutter sometimes: every 3 seconds or so the mouse would lock up for a few milliseconds.
I tracked it down to American Express's login page (auto loads if you leave the site idle) relying on Akamai's anti bot measures polling some web Bluetooth feature, causing Chrome to trigger a BT scan: https://castle.io/research/fingerprint-harvesting-in-the-bot...
Turning off Bluetooth solves it, but that's not a great solution when using a Bluetooth mouse... and it sounds like it might be causing your issue too.
It seems far more likely that your cheap hearing aids are sensitive to certain RF frequencies and the background javascript is causing different patterns of load on the phone's CPU.
I would suspect that this only happens when you're charging and it is likely the charger or cable not being properly shielded.
I noticed in the last few weeks that if I’d recently opened the AliExpress iOS app (ie. it was backgrounded) my car audio would freak out thinking I was giving it an audio command. Killing the AliExpress app immediately fixed the problem. After seeing it happen more than once I assumed it was something dodgey and uninstalled the app.
It's known that some Chinese mobile apps employ this trick to keep the app alive in the background, the rumor is that this way the 'active user' KPI can be better met.
i'd argue that perhaps the ability to play audio should be permission gated, much like the ability to use webcam/microphone.
However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to.
With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing this, I'll be more willing to be bothered every time I want to play a video with audio to approve it if this bothers me.
I would actually love if I could have iOS prompt me to allow certain apps to use the speakers. I hate using an app and suddenly have a video autoplay loudly.
Ah, so that's what Wolt (Doordash but in Europe) is doing.
I noticed that Voice Over (iOS screen reader) crackles and randomly changes volume when using the app, but I attributed it to standard iOS weirdness, and possibly misuse of some iOS API. Now I'm thinking that this may very well be fingerprinting.
Concerning situation, I think. And I suspect (perhaps wrongly) that there are even more reasons for concern with technology that can track, capture, leak etc. information that's more sensitive or valuable, depending on how one wishes to look at it. Mobile phones, computers, routers etc. -- all have the potential to siphon out valuable information to a bad actor, especially when it comes to espionage, military, commercial etc. This has already happened at a significant scael, so it's not a remote scenario.
At the very least, governments and institutions should develop a framework to investigate all acquired technology. The community / civil society could also create something similar, a script that would analyse at a deep level everything that can be analysed with a piece of software even by a complete novice.
Yes, I find it concerning too. I particularly dislike that windows was not aware, nor could it stop the audio stream from effecting the hardware. What other side channels like that exist? Perhaps I can be blamed for using windows
Recently I ran into a problem with my Bluetooth headphones. They support multipoint bluetooth audio, so they can be connected to my PC and phone at the same time.
Opening the Aliexpress webpage causes a silent audio stream keeping the PC>headphone link active blocking my phone audio.
An investigation reveals obfuscated code running device fingerprinting with a side effect being a silent audio stream that firefox, chrome and windows does not recognise but which kept the bluetooth connection active.
A part of me is always smiling a little inside when people find creative ways to abuse browsers. It's always one more demonstration that the current web is fundamentally broken by design. The distinction between web browsers and random programs that allow remore arbitrary code execution is becoming more and more academic with every new feature that gets exposed to JavaScript.
Of course, I am also a horrible hypocrite and will actually use websites that use features like WebUSB or WebRTC.
It was a mistake to normalize blindly executing whatever code the server sends your browser. One day we'll look back on this era and wish we had pulled the plug sooner.
Need to rethink the system that allows for (and encourages) this kind of plausible deniability. From "Oh we need this permission for [non essential feature] and you need to accept it if you want the app at all" -> to giving the user ultimate control over what happens on their personal device. Virtualize what the app can see and use fake data/identifiers/devices if necessary to get it to do what its supposed to. If the App isn't going to act in good faith why should the user? Fine grained permissions don't really work in practice because the app can keep annoying the user until they give in and hit Allow.
Also perhaps AI agents are now capable enough to run these apps the way the user would and recognize these dark patterns. Flag those and feed it back to a warning at the point of sale that users can upvote there to signal their disapproval and a threshold score that risks removal of the app from the store. Because bad behaviour continues to make business sense if the rules allow it. Moreover, it penalizes and puts pressure on the good actors as a "missed business opportunity".
What you want is basically how it works. On both phone platforms and PWAs, all permissions are visible to the user explicitly. All of them can be revoked at any time. Apps are disallowed from requesting an already-denied permission.
Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party software isn't under any obligation to work without them.
But the platforms have done what the platforms can do, at the architecture side, really. The next stage is human-audited enforcement of malware, which this AliExpress nonsense might hopefully run afoul of.
When I visit an article on a popular German tech news website, it interrupts music playback on my iPad (the website takes audio focus). I bet they do something similar.
Browser fingerprinting can get creative at times, to say the least. eBay's WebSocket port scanner [1] and Reddit's abuse of DRM and JavaScript JIT exploits [2] from years ago are two examples of the kind of in-depth introspection you can perform completely in the background using nothing more than simple non-permission-gated APIs.
Somebody (Mozilla?) should make a browser that just proactively blocks shit like this
I’m sure some Adblock addon could do it but at the browser level would be preferred. A browser vendor that just proactively does security and “correctness” tweaks to live sites would actually be in my interests as a user
IMO web browser have been enabling all sorts of obnoxious behavior since before JS. One of my all time favorites were the sites that opened pop-ups in a loop faster than you could close them while an audio clip of a guy yelling "Hey everyone! I'm looking at gay porn!" You had to hit reset. Fuck the Web.
Aha this would explain. I have seen similar behaviour with a news website trying DRM requests (has no reason to ask this info) resulting in stopping playback.. did not consider the impact of multipoint here. Interesting, might be worth looking into if i see this "bug" again.
Why are web pages allowed by default to do such things? Browsers should give the user the ability to forbid all sorts of thing and have them forbidden by default.
I had this (?) happen. I have a soundbar hooked up through spdif in my pc. It automatically switches sources, so I can play music through airplay and then have it play sounds from pc when I open youtube etc. So it switches from airplay music to pc even when nothing is playing on pc. This was happening on some websites and it is extremely annoying.
I notice this all of the time on sites with ads. I use AirPods to listen to music on my phone at work. Opening websites on my Mac routinely steals the AirPod connection but plays nothing audible.
I thought the App Store review guidelines explicitly prohibit hidden features and using public APIs outside their intended purpose. Is audio-based fingerprinting just not something review can realistically catch?
They probe all audio devices, including microphones, which probably temporarily switches Bluetooth devices into HPF mode due to how Bluetooth duplex audio works.
I'd argue it's "silent" though: aliexpress wakes up my audio card if nothing plays, which results in a very faint "pop" sound every time I open the tab.
The title of the article literally mentions "WebAudio", and the first paragraph states that the author is using a PC. The second paragraph mentions Chrome and Firefox.
Apple and the App Store have zero involvement here.
The script generates a known waveform, it is passed through the browser's audio implementation and then the script analyses the result after. Based on your devices settings and hardware the output will be different, e.g. a PC with analog output might have 44KHz audio output bandwidth, but a bluetooth headset might have a lower, different audio bandwidth. That is a datapoint that can be used in device fingerprinting alongside screen and viewport dimensions,
device pixel ratio, browser plugins, etc.
This is not limited to Bluetooth in any way. In pavucontrol I can see Firefox outputting audio when on AliExpress even though nothing is playing. The uBlock filter fixed it.
That could explain the multipoint problems I've had in the last weeks, where audio would get "stuck" to one of my devices even when (apparently) nothing is playing.
No sound playing but the audio would change like the microphone was being activated. I checked permissions to make sure there was no mic access and figured that they were fingerprinting.
Can we just limit web APIs to cookies and the likes as before? I don’t like how JavaScript has access to so many devices on the host. It’s a security and privacy nightmare.
We need to find a solution to browsers sniffing on people. This here refers to AliExpress, but which browsers are typically spying on people like that in the first place? That's the real primary problem.
It's not just BT audio. In windows PC, if aliexpress is opened in one tab in chrome, and switching to a tab with youtube opened, audio don't play in this tab if you start playing youtube.
If this wasn't such a serious issue I'd be inclined to make a joke about being surprised that AliExpress was capable of such a thing, but I guess the complete shitshow of a website is intentional.
I wouldn't be surprised if what I'm feeling is all a psychological thing where consumers associate jank with low prices so that's why sites like AliExpress and Temu look like a complete technical mess when in reality they're doing pretty advanced stuff like this.
Meanwhile ppl freak out over Anthropic using timezone and Unicode for the same purpose, without realizing Chinese are simply ruthless in abusing iOS or Android or Web. Pinduoduo, who owns Temu, is infamous for exploiting an Android 0day vulnerability for such purposes.
I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days.
Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content...
Now I wonder, does this also allow websites to continue running in the background on mobile browsers? Playing media is one of the very few things that can convince iOS Safari to keep a tab running indefinitely, in my experience.
Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.
I wonder if it is something firefox and chrome devs need to look at because if it is accessing the audio device surely it should be notified to the user.
It does on my Firefox, I had to close their tab because it also tricks kde into thinking I'm playing audio.
It should instead trigger a little germ icon, like a virus, because it's like a virus.
It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period.
Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.
The speaker icon would be handy but I think that it depends from both the good will of Firefox and the installed add ons. Of course if an add on blocks the audio file there is no need to display the speaker icon for that file.
To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my Android phone. It shows a number of sites. Nothing in first party and these that I must fully enable to make the site work (css, image, script, xhr)
* aliexpress.com
* ase.aliexpress.com
* it.aliexpress.com (my country two letters domain)
* umdc-global.aliexpress.com
* aidcgroup.net
* ase.aidcgroup.net
* 67372.ase.aidcgroup.net
* alibaba-inc.com
* epss.alibaba-inc.com
* alicdn.com
* ae01.alicdn.com
* assets.alicdn.com
* aliexpress-media.com
* ae-pic-a1.aliexpress-media.com
* assets.aliexpress-media.com
* aliyun.com
* acjs.aliyun.com
Scary list, right? According to google aidcroup is
> Alibaba International IPP Platform
> https://ipp.aidcgroup.net
> Alibaba International is committed to the protection of intellectual property rights. Right holders and their agents can enforce intellectual property ...
Let me add a /s to the last line
There are two more sites that I can completely block
* googlesyndication.com
* pagead2.googlesyndication.com
so even Alibaba runs ads on Google.
I did not instrument the browser like the author of the post did, so I don't know where the audio comes from. There is nothing listed in the media column of uMatrix. This does not mean that the post is inaccurate. It could be that the browser gets the audio stream from a request in one of the other categories.
uBlockOrigin blocks two of other requests.
1. https://g.alicdn.com/code/npm/@ali/gmod-pop-disclosure-code/...
and this one that I anonymize
2. https://aplus.aliexpress.com/g.gif?logtype=0&title=WebPush Permission&pre=https://it.aliexpress.com/?gatewayAdapt=glo2ita&scr=1920x1080&_p_url=https://it.aliexpress.com/wp.html&cna=<whatever cna is>&category=&aplus=&$${beacon_mini}$$=&yunid=&=&trid=<trid>&asid=<base64 stuff>$${get_sign}$$&p=1&o=linux&b=firefox153&s=1920x1080&w=gecko&ism=other&cache=<7 letters>&lver=8.15.25&jsver=aplus_std&pver=0.7.12&_pw=0&_ph=0&tag=1&stag=-1&lstag=-1&_slog=0
Probably the audio file is coming from one of the unblocked requests but my Debian laptop does not pair with my Bluetooth earpieces so I can't test it.
I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue.
@FireFoxDudes You need to be addressing fingerprinting
With my previous hearing aid I noticed that visiting a wide variety of web sites would cause a change in the amplification of environmental noise. I always assumed it was doing something with Bluetooth, and probably not for a good reason. This is with an iPhone 13 and one Kirkland/phonak hearing aid.
I haven’t noticed this recently, but I also now have two newer Phonak hearing aids and a few iOS updates have happened. Maybe the silent Bluetooth shenanigans are less disruptive to my new aids or the programming is different. Surely shenanigans continue.
It's the Bluetooth; when Bluetooth connects most hearing aids reduce the environmental volume slightly so you can hear the streaming content. Some app has started to play audio (perhaps silently). I notice it on some websites.
How much HAs reduce environmental sounds when streaming is configurable by the way, but only by the audiologist if you don't have your own programmer. I don't like the effect and prefer to just turn down the volume manually.
I wear Phonak CI processors. It's not just you. I've also experienced the volume drop on a few sites and apps. The Amazon iOS app does this. Each time I leave the app, ambient audio returns to normal.
I noticed my MBP had a periodic stutter sometimes: every 3 seconds or so the mouse would lock up for a few milliseconds.
I tracked it down to American Express's login page (auto loads if you leave the site idle) relying on Akamai's anti bot measures polling some web Bluetooth feature, causing Chrome to trigger a BT scan: https://castle.io/research/fingerprint-harvesting-in-the-bot...
Turning off Bluetooth solves it, but that's not a great solution when using a Bluetooth mouse... and it sounds like it might be causing your issue too.
It seems far more likely that your cheap hearing aids are sensitive to certain RF frequencies and the background javascript is causing different patterns of load on the phone's CPU.
I would suspect that this only happens when you're charging and it is likely the charger or cable not being properly shielded.
I noticed in the last few weeks that if I’d recently opened the AliExpress iOS app (ie. it was backgrounded) my car audio would freak out thinking I was giving it an audio command. Killing the AliExpress app immediately fixed the problem. After seeing it happen more than once I assumed it was something dodgey and uninstalled the app.
I cannot ever imagine installing something like AliExpress as an app.
And that's OK with Apple's App review?
It's known that some Chinese mobile apps employ this trick to keep the app alive in the background, the rumor is that this way the 'active user' KPI can be better met.
edit: quantity qualifier
So Apple will remove them from the App Store. Thats their whole argument for their closed system - they’ll protect users from malicious apps. Right?
it's not the app that it's malicious, it's the website
i'd argue that perhaps the ability to play audio should be permission gated, much like the ability to use webcam/microphone.
However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to.
With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing this, I'll be more willing to be bothered every time I want to play a video with audio to approve it if this bothers me.
I would actually love if I could have iOS prompt me to allow certain apps to use the speakers. I hate using an app and suddenly have a video autoplay loudly.
The ability to play audio can usually be permission gated with tab muting, however the methods aliexpress use bypass that mechanism completely.
Ah, so that's what Wolt (Doordash but in Europe) is doing.
I noticed that Voice Over (iOS screen reader) crackles and randomly changes volume when using the app, but I attributed it to standard iOS weirdness, and possibly misuse of some iOS API. Now I'm thinking that this may very well be fingerprinting.
Concerning situation, I think. And I suspect (perhaps wrongly) that there are even more reasons for concern with technology that can track, capture, leak etc. information that's more sensitive or valuable, depending on how one wishes to look at it. Mobile phones, computers, routers etc. -- all have the potential to siphon out valuable information to a bad actor, especially when it comes to espionage, military, commercial etc. This has already happened at a significant scael, so it's not a remote scenario.
At the very least, governments and institutions should develop a framework to investigate all acquired technology. The community / civil society could also create something similar, a script that would analyse at a deep level everything that can be analysed with a piece of software even by a complete novice.
Yes, I find it concerning too. I particularly dislike that windows was not aware, nor could it stop the audio stream from effecting the hardware. What other side channels like that exist? Perhaps I can be blamed for using windows
Recently I ran into a problem with my Bluetooth headphones. They support multipoint bluetooth audio, so they can be connected to my PC and phone at the same time. Opening the Aliexpress webpage causes a silent audio stream keeping the PC>headphone link active blocking my phone audio. An investigation reveals obfuscated code running device fingerprinting with a side effect being a silent audio stream that firefox, chrome and windows does not recognise but which kept the bluetooth connection active.
Is this an AI summary of the article?
A part of me is always smiling a little inside when people find creative ways to abuse browsers. It's always one more demonstration that the current web is fundamentally broken by design. The distinction between web browsers and random programs that allow remore arbitrary code execution is becoming more and more academic with every new feature that gets exposed to JavaScript.
Of course, I am also a horrible hypocrite and will actually use websites that use features like WebUSB or WebRTC.
It was a mistake to normalize blindly executing whatever code the server sends your browser. One day we'll look back on this era and wish we had pulled the plug sooner.
This article writing is really clean and enjoyable to read. And I learnt something.
Thank you very much.
Need to rethink the system that allows for (and encourages) this kind of plausible deniability. From "Oh we need this permission for [non essential feature] and you need to accept it if you want the app at all" -> to giving the user ultimate control over what happens on their personal device. Virtualize what the app can see and use fake data/identifiers/devices if necessary to get it to do what its supposed to. If the App isn't going to act in good faith why should the user? Fine grained permissions don't really work in practice because the app can keep annoying the user until they give in and hit Allow.
Also perhaps AI agents are now capable enough to run these apps the way the user would and recognize these dark patterns. Flag those and feed it back to a warning at the point of sale that users can upvote there to signal their disapproval and a threshold score that risks removal of the app from the store. Because bad behaviour continues to make business sense if the rules allow it. Moreover, it penalizes and puts pressure on the good actors as a "missed business opportunity".
What you want is basically how it works. On both phone platforms and PWAs, all permissions are visible to the user explicitly. All of them can be revoked at any time. Apps are disallowed from requesting an already-denied permission.
Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party software isn't under any obligation to work without them.
But the platforms have done what the platforms can do, at the architecture side, really. The next stage is human-audited enforcement of malware, which this AliExpress nonsense might hopefully run afoul of.
I’ve noticed this and on other apps too, it breaks AirPods and when background playing Spotify it’s very obvious.
Thanks for investigating! Makes sense it’s also in the taobao app on ios too.
When I visit an article on a popular German tech news website, it interrupts music playback on my iPad (the website takes audio focus). I bet they do something similar.
Browser fingerprinting can get creative at times, to say the least. eBay's WebSocket port scanner [1] and Reddit's abuse of DRM and JavaScript JIT exploits [2] from years ago are two examples of the kind of in-depth introspection you can perform completely in the background using nothing more than simple non-permission-gated APIs.
[1] https://blog.nem.ec/2020/05/24/ebay-port-scanning/
[2] https://iter.ca/post/reddit-whiteops/
Thanks for the reads
I think x.com does this too - haven't been able to dig deeper.
I wonder if this is something the iOS Facebook app also does? It constantly pauses my Apple Music playing. Soooo irritating.
I've seen this on many many other sites as well, most notably Twitter, and lots of common modern captcha pages too. Very annoying!
Somebody (Mozilla?) should make a browser that just proactively blocks shit like this
I’m sure some Adblock addon could do it but at the browser level would be preferred. A browser vendor that just proactively does security and “correctness” tweaks to live sites would actually be in my interests as a user
JS enabled by default seems every day less secure.
So many website break completely with JS disabled and you end up having to enable it half the time anyway.
IMO web browser have been enabling all sorts of obnoxious behavior since before JS. One of my all time favorites were the sites that opened pop-ups in a loop faster than you could close them while an audio clip of a guy yelling "Hey everyone! I'm looking at gay porn!" You had to hit reset. Fuck the Web.
Aha this would explain. I have seen similar behaviour with a news website trying DRM requests (has no reason to ask this info) resulting in stopping playback.. did not consider the impact of multipoint here. Interesting, might be worth looking into if i see this "bug" again.
Why are web pages allowed by default to do such things? Browsers should give the user the ability to forbid all sorts of thing and have them forbidden by default.
I had this (?) happen. I have a soundbar hooked up through spdif in my pc. It automatically switches sources, so I can play music through airplay and then have it play sounds from pc when I open youtube etc. So it switches from airplay music to pc even when nothing is playing on pc. This was happening on some websites and it is extremely annoying.
Is there any particular reason these kinds of APIs are not behind permission prompts?
I notice this all of the time on sites with ads. I use AirPods to listen to music on my phone at work. Opening websites on my Mac routinely steals the AirPod connection but plays nothing audible.
I thought the App Store review guidelines explicitly prohibit hidden features and using public APIs outside their intended purpose. Is audio-based fingerprinting just not something review can realistically catch?
They probe all audio devices, including microphones, which probably temporarily switches Bluetooth devices into HPF mode due to how Bluetooth duplex audio works.
I'd argue it's "silent" though: aliexpress wakes up my audio card if nothing plays, which results in a very faint "pop" sound every time I open the tab.
It's been this way for ~3+ years at least.
It's the website.
The title of the article literally mentions "WebAudio", and the first paragraph states that the author is using a PC. The second paragraph mentions Chrome and Firefox.
Apple and the App Store have zero involvement here.
Are you not required to grant an explicit permission for it to access audio? If not that is highly disturbing.
Just curious, why silent sound would allow fingerprinting? What are they sampling if it can't be heard?
The script generates a known waveform, it is passed through the browser's audio implementation and then the script analyses the result after. Based on your devices settings and hardware the output will be different, e.g. a PC with analog output might have 44KHz audio output bandwidth, but a bluetooth headset might have a lower, different audio bandwidth. That is a datapoint that can be used in device fingerprinting alongside screen and viewport dimensions, device pixel ratio, browser plugins, etc.
This at least partially contributed to a sleep related Firefox bug on Windows:
https://bugzilla.mozilla.org/show_bug.cgi?id=1863193
This is not limited to Bluetooth in any way. In pavucontrol I can see Firefox outputting audio when on AliExpress even though nothing is playing. The uBlock filter fixed it.
That could explain the multipoint problems I've had in the last weeks, where audio would get "stuck" to one of my devices even when (apparently) nothing is playing.
Trying to debug this as a normal user is basically hopeless, you would never think to suspect a shopping tab. Glad someone did the legwork.
Bluetooth is such a mess. You know what didn't have this problem? Cables.
90% of this stuff should be illegal
They have been doing this for months.
No sound playing but the audio would change like the microphone was being activated. I checked permissions to make sure there was no mic access and figured that they were fingerprinting.
This is the reason I use adguard everywhere
Besides the privacy implications, they are also wasting our fucking batteries on this crap...
This sounds like a GDPR issue no? Couldn't they be taken to the EU!
Sounds like we're gonna need browsers to pop an audio playback permission, as annoying as that seems. Abusive sites just can't help themselves.
There is no legit reason to be doing this.
OP please submit the filter to an upstream uBlock filter list.
> distinguish normal shoppers from automated
Why? Are you afraid of robots making you rich?
Can we just limit web APIs to cookies and the likes as before? I don’t like how JavaScript has access to so many devices on the host. It’s a security and privacy nightmare.
We need to find a solution to browsers sniffing on people. This here refers to AliExpress, but which browsers are typically spying on people like that in the first place? That's the real primary problem.
Cloudflare challenges also use Web Audio, by the way.
Are there any EU/GDPR laws against fingerprinting?
It's not just BT audio. In windows PC, if aliexpress is opened in one tab in chrome, and switching to a tab with youtube opened, audio don't play in this tab if you start playing youtube.
If this wasn't such a serious issue I'd be inclined to make a joke about being surprised that AliExpress was capable of such a thing, but I guess the complete shitshow of a website is intentional.
I wouldn't be surprised if what I'm feeling is all a psychological thing where consumers associate jank with low prices so that's why sites like AliExpress and Temu look like a complete technical mess when in reality they're doing pretty advanced stuff like this.
Another reason why Lockdown mode on iOS is your friend.
[dead]
[flagged]
[dead]
Meanwhile ppl freak out over Anthropic using timezone and Unicode for the same purpose, without realizing Chinese are simply ruthless in abusing iOS or Android or Web. Pinduoduo, who owns Temu, is infamous for exploiting an Android 0day vulnerability for such purposes.