Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

Post reply on HN
Print view View original

71–80 of 349 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#71

Post by ivanjermakov »

lukeify wrote: post #9
patspam wrote: post #8

I noticed in the last few weeks that if I’d recently opened the AliExpress iOS app (ie. it was backgrounded) my car audio would freak out thinking I was giving it an audio command. Killing the AliExpress app immediately fixed the problem. After seeing it happen more than once I assumed it was something dodgey and uninstalled the app.

I cannot ever imagine installing something like AliExpress as an app.

Not sure if they still do, but a couple years ago prices in the app were lower than on the website. And they promoted installing it to save money.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#72

Post by drdexebtjl »

ajross wrote: post #63
pyaamb wrote: post #60

Need to rethink the system that allows for (and encourages) this kind of plausible deniability. From "Oh we need this permission for [non essential feature] and you need to accept it if you want the app at all" -> to giving the user ultimate control over what happens on their personal device. Virtualize what the app can see and use fake data/identifiers/devices if necessary to get it to do what its supposed to. If th…

What you want is basically how it works. On both phone platforms and PWAs, all permissions are visible to the user explicitly. All of them can be revoked at any time. Apps are disallowed from requesting an already-denied permission. Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party softwa…

>Obviously apps can tell if they haven't been granted a permission

By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission.

In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#73

Post by genidoi »

echoangle wrote: post #68
ngl999 wrote: post #14

Earlier quoted context omitted.

It's known that some Chinese mobile apps employ this trick to keep the app alive in the background, the rumor is that this way the 'active user' KPI can be better met. edit: quantity qualifier

Why would they manipulate the numbers that way if it’s self-reported anyways? If you want to fake the numbers, couldn’t you just change the number and be done?

It's probably quite difficult to manipulate per-user metrics after the data is collected.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#74

Post by somehnguy »

lovestory wrote: post #34
lukeify wrote: post #9

Earlier quoted context omitted.

I cannot ever imagine installing something like AliExpress as an app.

You probably buy things off amazon that are dropshipped from AliExpress all the time. Stop with the elitism

Having bought many things off AliExpress over the years I can say with complete confidence that I've never made a purchase on Amazon that was dropshipped from Ali. The shipping times are far different and it would be immediately obvious.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#76

Post by ValdikSS »

sillyboi wrote: post #75

I thought the App Store review guidelines explicitly prohibit hidden features and using public APIs outside their intended purpose. Is audio-based fingerprinting just not something review can realistically catch?

They probe all audio devices, including microphones, which probably temporarily switches Bluetooth devices into HPF mode due to how Bluetooth duplex audio works.

I'd argue it's "silent" though: aliexpress wakes up my audio card if nothing plays, which results in a very faint "pop" sound every time I open the tab.

It's been this way for ~3+ years at least.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#78

Post by emctech »

ankushdograuk wrote: post #57

This is the reason I use adguard everywhere

I use ublock origin and by default it wasn't blocking, i had to make a custom filter to block the scripts in order for it to prevent the audio takeover. Maybe adguard does a better job? Someone else suggested just wholesale disabling of JS but it is the nuclear option.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#79

Post by gmueckl »

A part of me is always smiling a little inside when people find creative ways to abuse browsers. It's always one more demonstration that the current web is fundamentally broken by design. The distinction between web browsers and random programs that allow remore arbitrary code execution is becoming more and more academic with every new feature that gets exposed to JavaScript.

Of course, I am also a horrible hypocrite and will actually use websites that use features like WebUSB or WebRTC.

Post reply on HN