Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

Post reply on HN
Print view View original

101–110 of 347 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#101

Post by subscribed »

somehnguy wrote: post #74
lovestory wrote: post #34

Earlier quoted context omitted.

You probably buy things off amazon that are dropshipped from AliExpress all the time. Stop with the elitism

Having bought many things off AliExpress over the years I can say with complete confidence that I've never made a purchase on Amazon that was dropshipped from Ali. The shipping times are far different and it would be immediately obvious.

I've ordered things from AliExpress shipped from the local warehouses (2-3 days delivery) ; I've ordered things on Amazon UK that were fulfilled and shipped from Amazon UK that were delivered in 3-5 working days.

Not a £1 tat, and not one off. Not that AliExpress is my choice, no, far from it. Sometimes it's better, closer to the manufacturer, that's all.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#103

Post by voakbasda »

echoangle wrote: post #68
ngl999 wrote: post #14

Earlier quoted context omitted.

It's known that some Chinese mobile apps employ this trick to keep the app alive in the background, the rumor is that this way the 'active user' KPI can be better met. edit: quantity qualifier

Why would they manipulate the numbers that way if it’s self-reported anyways? If you want to fake the numbers, couldn’t you just change the number and be done?

The people fudging the metric (developers) may not be the same people that are relying on the metrics (managers). Perverse incentives at play could easily motivate this kind of shenanigan.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#104

Post by voakbasda »

rcruzeiro wrote: post #46
compsciphd wrote: post #6

i'd argue that perhaps the ability to play audio should be permission gated, much like the ability to use webcam/microphone. However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to. With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing t…

I would actually love if I could have iOS prompt me to allow certain apps to use the speakers. I hate using an app and suddenly have a video autoplay loudly.

This. This needs to be a thing.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#105

Post by handle584 »

Meanwhile ppl freak out over Anthropic using timezone and Unicode for the same purpose, without realizing Chinese are simply ruthless in abusing iOS or Android or Web. Pinduoduo, who owns Temu, is infamous for exploiting an Android 0day vulnerability for such purposes.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#106

Post by rootusrootus »

somehnguy wrote: post #74
lovestory wrote: post #34

Earlier quoted context omitted.

You probably buy things off amazon that are dropshipped from AliExpress all the time. Stop with the elitism

Having bought many things off AliExpress over the years I can say with complete confidence that I've never made a purchase on Amazon that was dropshipped from Ali. The shipping times are far different and it would be immediately obvious.

Yeah it would be hard to hide. When I order from AliExpress it arrives via Chinese carriers I have never even hard of, and about half the time the final delivery is through a Chinese gig delivery company that must pay practically nothing to the driver because they will usually drive up in front of my house and chuck the package out the window onto my front lawn.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#107

Post by grishka »

MisterTea wrote: post #28
nkjoep wrote: post #16

JS enabled by default seems every day less secure.

IMO web browser have been enabling all sorts of obnoxious behavior since before JS. One of my all time favorites were the sites that opened pop-ups in a loop faster than you could close them while an audio clip of a guy yelling "Hey everyone! I'm looking at gay porn!" You had to hit reset. Fuck the Web.

Opening a popup needs JS though.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#108

Post by voakbasda »

victorbjorklund wrote: post #87
drdexebtjl wrote: post #72

Earlier quoted context omitted.

>Obviously apps can tell if they haven't been granted a permission By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission. In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.

Soundd like a nightmare to build legitimate apps if you for example are building an app that uses the camera but you can’t in anyway tell that using the camera fails (because user had denied the permission 6 months ago and has no memory of it) and instead of being able to give a helpful error you are just ending up with I am guessing fake images (maybe just a black screen).

The image could contain a message that it is disabled.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#109

Post by vlachen »

ivanjermakov wrote: post #98
coldtea wrote: post #96

Earlier quoted context omitted.

And someone would install random apps to save $5 on $100 purchases?

You'd be surprised on what general public can go to save $5.

I mean, I'm haunted by the things I did for a Klondike Bar.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#110

Post by left-struck »

emctech wrote: post #56
maximilianthe1 wrote: post #50

Earlier quoted context omitted.

Is this an AI summary of the article?

No, I took the first sentence of my article and then edited the rest of the intro + conclusion to keep it short for HN.

You should make that obvious in some way like using “TLDR”. I assume many people, like me, would attempt to parse your comment as a comment on the article, after all it’s in the comment section, and read that way it’s very confusing lol.
Post reply on HN