Researcher Matthew Callaghan discovered that AliExpress was employing an inaudible sound-based fingerprinting method to identify and track website visitors. The discovery occurred when he noticed his Bluetooth headphones stopped playing audio from his phone each time he loaded the AliExpress homepage, with the issue resolving when he closed the browser tab.
Investigating the phenomenon, Callaghan found two heavily obfuscated scripts working in tandem to analyze WebAudio data from browsers. The scripts generated a Sawtooth wave oscillator that measured frequency characteristics of the browser’s audio processing. By setting the audio gain to zero, the scripts prevented users from hearing the generated sounds, yet the browser continued processing the audio signal and transmitted the resulting data to AliExpress. This technique exploited variations in mathematical libraries used across different systems and browsers to create unique identifying signatures.
The audio fingerprinting method has become largely ineffective on modern browsers due to security improvements. Firefox implemented protections beginning in version 118 released in 2023, shifting to standardized mathematical libraries rather than relying on operating system-specific ones. Chrome similarly protects users through its own bundled libraries, and Safari likely provides comparable protection. A Google spokesperson confirmed the technique’s ineffectiveness in Chrome, while Apple had not yet commented on Safari’s protection status.
The fact that AliExpress continues using this obsolete technique suggests it may be an oversight from earlier implementation, particularly given that the retailer was simultaneously employing more than a dozen additional fingerprinting methods. This raises broader concerns about widespread tracking practices across the internet, as thousands of other websites likely utilize similar identification techniques. Browser developers and website operators remain engaged in an ongoing competition, with companies constantly seeking new tracking methods while browser makers work to implement protective measures.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI