A researcher identified that AliExpress employs browser fingerprinting through an inaudible audio measurement technique after noticing disruptions to his multipoint Bluetooth headphones when visiting the site. Matthew Callaghan discovered that loading the AliExpress homepage caused audio from his phone to stop playing through his headphones, a pattern that repeated consistently and reversed when he closed the site’s tab.
Investigation of the phenomenon led Callaghan to find two heavily obfuscated scripts that generated a graph analyzing WebAudio readings from each visitor’s browser. The scripts created an oscillator measuring Sawtooth waves common in digital audio output, with the gain intentionally set to zero to prevent audible sounds. Despite being inaudible, the browser continued processing the audio signal and transmitted it to AliExpress, allowing the company to generate a unique fingerprint based on how the browser’s audio implementation handled the waveform.
The audio fingerprinting method exploits variability in math libraries used across different systems and processors to create distinctive signatures. However, Firefox addressed this vulnerability in version 118 released in 2023 by implementing its own standardized math libraries rather than relying on operating system-level libraries, reducing the entropy sufficiently to disable the technique. Chrome similarly ships with its own libraries, rendering the method ineffective there, while Safari users likely benefit from comparable protections.
The discovery raises questions about why AliExpress continues deploying an obsolete tracking method alongside more than a dozen other fingerprinting techniques already in use on the platform. Industry observers suggest the audio approach may represent legacy code that persisted unnoticed rather than an active tracking strategy. The finding underscores ongoing tension between browser developers implementing privacy protections and website operators seeking alternative tracking methods, with thousands of sites likely employing similar approaches.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI