Live data from Hacker News

“Ultrasonic cross-device tracking” embeds inaudible tones in advertisements

arstechnica.com

41–50 of 127 posts

Re: “Ultrasonic cross-device tracking” embeds inaudible tones in advertisements

#41
post #3
post #2

I know it's Ars, but there has to be a better link with more detail than "here's a thing some people might be doing, somewhere."

Take a look at Chirp: http://www.chirp.io/ Edit: In Firefox it seems this website is constantly playing audio. I think it is using a WebSocket to do this. Since I don't hear a thing I'm not sure what is going on here.

Since I don't hear a thing I'm not sure what is going on here.

Click on the gem and the web page will play a "chirp," which is loud and beepy and not ultrasonic or secret at all. It's an analog modem type system, except probably way slower than 300 or even 110 baud. Everything old is new again, I guess.

In any case, the point is: the Chirp system is distinct from the supposedly-possible secret systems the Ars story is fretting over.

I've seen several articles worrying about the use and abuse of data transmission via secret ultrasound, but I've never seen any claims that named names or that offered a way for readers to verify or check anything.

I don't think you can count on the average laptop/phone speakers, mics, and digital audio systems to deal with ultrasound.

If a computer's audio drivers and audio hardware are set up to play back at standard CD/DVD sample rates (44KHz or 48KHz), then ultrasonics are not happening there, period. The same principle applies to inputs.

Even if all the hardware and software on two devices is capable of and configured for producing/receiving ultrasonic frequencies, it seems pretty likely that loud ultrasonic screeches played on a 50-cent cell-phone speaker would produce audible harmonics, and the jig would be up.

I expect secret ultrasonic data transmission over commodity systems is the sort of thing a well funded state organization might turn to for a targeted operation. Because it might work under exactly the right circumstances, but it would be fiddly and terrible for general use.

Re: “Ultrasonic cross-device tracking” embeds inaudible tones in advertisements

#42
post #27

I wasn't aware (and would be surprised if) iOS apps with microphone privileges could listen all the time, even while in the background, which is really what would be required in this situation. Is that really the case, or is the Ars piece suggesting I would be walking around with the advertiser's enabled app open all the time? (And I'd guess Android is in a similar boat.)

On iOS there is a prominent red banner informing an app is listening if it is listening in the background.

Also, if I'm not mistaken, only 1 app can listen at a time.

Re: “Ultrasonic cross-device tracking” embeds inaudible tones in advertisements

#43
post #27

I wasn't aware (and would be surprised if) iOS apps with microphone privileges could listen all the time, even while in the background, which is really what would be required in this situation. Is that really the case, or is the Ars piece suggesting I would be walking around with the advertiser's enabled app open all the time? (And I'd guess Android is in a similar boat.)

On iOS there is a prominent red banner informing an app is listening if it is listening in the background.

Also, if I'm not mistaken, only 1 app can listen at a time.

Re: “Ultrasonic cross-device tracking” embeds inaudible tones in advertisements

#44
post #3

Earlier quoted context omitted.

Take a look at Chirp: http://www.chirp.io/ Edit: In Firefox it seems this website is constantly playing audio. I think it is using a WebSocket to do this. Since I don't hear a thing I'm not sure what is going on here.

Since I don't hear a thing I'm not sure what is going on here. Click on the gem and the web page will play a "chirp," which is loud and beepy and not ultrasonic or secret at all. It's an analog modem type system, except probably way slower than 300 or even 110 baud. Everything old is new again, I guess. In any case, the point is: the Chirp system is distinct from the supposedly-possible secret systems the Ars story i…

Are there other devices besides the audio driver that could produce ultrasonic sounds when driven in a certain way?

Re: “Ultrasonic cross-device tracking” embeds inaudible tones in advertisements

#45

Is this why Gmail requires microphone privileges? I've been looking for a feature in the app that actually needs it and have been coming up empty.

The search functionality supports voice input, so maybe that?

Re: “Ultrasonic cross-device tracking” embeds inaudible tones in advertisements

#46
This is reaching the point where the only sensible policy is to flat-out prohibit all forms of adverting on any medium. Paying a company to lie to you is already a pretty bizarre idea but the invasion of privacy - online or offline - makes advertising increasingly intolerable.

Re: “Ultrasonic cross-device tracking” embeds inaudible tones in advertisements

#47
post #3

Earlier quoted context omitted.

Take a look at Chirp: http://www.chirp.io/ Edit: In Firefox it seems this website is constantly playing audio. I think it is using a WebSocket to do this. Since I don't hear a thing I'm not sure what is going on here.

Since I don't hear a thing I'm not sure what is going on here. Click on the gem and the web page will play a "chirp," which is loud and beepy and not ultrasonic or secret at all. It's an analog modem type system, except probably way slower than 300 or even 110 baud. Everything old is new again, I guess. In any case, the point is: the Chirp system is distinct from the supposedly-possible secret systems the Ars story i…

I think that most people (not teenagers) cannot hear past 15 kHz, especially with other sounds playing. This is reproducible at standard sampling rates you mention.

Harmonics are integer multiples of frequencies. Harmonics of an ultrasonic signal are even more ultrasonic. If there's any aliasing, those harmonics might map back to audible frequencies. However, no matter how cheap a speaker is, no aliasing happens. Perhaps there's another reason why an ultrasonic waveform might be audible when played through a cheap speaker, but not because of harmonics, right?

Re: “Ultrasonic cross-device tracking” embeds inaudible tones in advertisements

#48
post #3

Earlier quoted context omitted.

Take a look at Chirp: http://www.chirp.io/ Edit: In Firefox it seems this website is constantly playing audio. I think it is using a WebSocket to do this. Since I don't hear a thing I'm not sure what is going on here.

Since I don't hear a thing I'm not sure what is going on here. Click on the gem and the web page will play a "chirp," which is loud and beepy and not ultrasonic or secret at all. It's an analog modem type system, except probably way slower than 300 or even 110 baud. Everything old is new again, I guess. In any case, the point is: the Chirp system is distinct from the supposedly-possible secret systems the Ars story i…

> If a computer's audio drivers and audio hardware are set up to play back at standard CD/DVD sample rates (44KHz or 48KHz), then ultrasonics are not happening there, period. The same principle applies to inputs.

What do you mean? All you need to do is sample the received audio at 44.1 kHz. Android at least has a low-level API which allows you to customize sampling rate.

Re: “Ultrasonic cross-device tracking” embeds inaudible tones in advertisements

#49
I'm working on an app that passively picks up ultrasonic tones generated by SilverPush and sends out garbled data.

The biggest issue with blanket interference across the entire ultrasonic band is that there are some legitimate uses that don't involve cross-device tracking. That's why we need to address this issue by selectively interfering with only known tracking schemes.

Re: “Ultrasonic cross-device tracking” embeds inaudible tones in advertisements

#50
post #46

This is reaching the point where the only sensible policy is to flat-out prohibit all forms of adverting on any medium. Paying a company to lie to you is already a pretty bizarre idea but the invasion of privacy - online or offline - makes advertising increasingly intolerable.

Some people say your attention is your most valuable asset. Stealing ones attention is unethical in my mind.
Post reply on HN