A researcher identified that AliExpress employs browser fingerprinting technology through inaudible audio signals sent to visitors’ browsers. The discovery occurred when Matthew Callaghan noticed his Bluetooth headphones experienced disrupted connectivity each time he accessed the AliExpress homepage. Upon investigation, he found two heavily obfuscated scripts that created audio graphs measuring WebAudio readings across visiting browsers.
The fingerprinting mechanism operates by generating a known waveform through an oscillator that analyzes Sawtooth waves, which are typical outputs from digital audio systems. The scripts establish audio gain at zero to prevent users from hearing the signals, yet the browser continues processing the audio data connected to system output and transmits the information to AliExpress. This technique relies on variations in mathematical libraries used during browser audio processing, combined with differences in CPU architecture and other system components, to generate unique device signatures.
Firefox addressed this fingerprinting method starting in version 118 released in 2023 by implementing its own standardized mathematical libraries rather than relying on operating system-level ones, reducing the uniqueness of signatures sufficiently to render the technique ineffective. Chrome similarly ships with proprietary libraries, making the technique unsuccessful on that browser. Safari users likely benefit from the same protection, though Apple has not confirmed this directly.
The discovery raises questions about why AliExpress continues deploying an obsolete tracking method when the retailer utilizes more than a dozen other fingerprinting techniques. Security experts suggest the audio-based approach may represent legacy code that has gone unnoticed rather than an intentional tracking strategy. While browser manufacturers have implemented countermeasures against this particular technique, the broader fingerprinting threat persists, with evidence suggesting thousands of websites employ similar tracking methods. Browser developers and website publishers remain engaged in ongoing efforts to outpace protective measures.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI