Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

141–150 of 348 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#141
post #19

Earlier quoted context omitted.

Will do! edit - How do i do this? through github issues? https://github.com/uBlockOrigin/uAssets/issues

They said they aren't interested

chimed in... thank you for the great documentation!

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#142
post #8

I noticed in the last few weeks that if I’d recently opened the AliExpress iOS app (ie. it was backgrounded) my car audio would freak out thinking I was giving it an audio command. Killing the AliExpress app immediately fixed the problem. After seeing it happen more than once I assumed it was something dodgey and uninstalled the app.

And that's OK with Apple's App review?

I'm wondering if the reviewers neglected to review the app while driving a car and listening to audio.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#143
post #8

I noticed in the last few weeks that if I’d recently opened the AliExpress iOS app (ie. it was backgrounded) my car audio would freak out thinking I was giving it an audio command. Killing the AliExpress app immediately fixed the problem. After seeing it happen more than once I assumed it was something dodgey and uninstalled the app.

And that's OK with Apple's App review?

They let all sorts of stuff that they shouldn't in.

For instance, Meta and Google publish 'free' iOS libraries that firehose surveillance data back to them. The libraries are popular, so apps that use them must be allowed into the store despite taking them as dependencies.

If you can get access to .ipa files (I think you'd need to jailbreak -- apparently this stuff is encrypted by Apple) or packet sniffer, then you can get an idea of how bad it is for the apps you use.

This tool claims to do the sort of analysis I'm talking about (among other things), but I've never tried:

https://securitywall.co/tools/ipa-analyzer

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#144
post #96

Earlier quoted context omitted.

Not sure if they still do, but a couple years ago prices in the app were lower than on the website. And they promoted installing it to save money.

And someone would install random apps to save $5 on $100 purchases?

eBay keeps pushing their app with a $5 discount, advertised using a focus-stealing popup interrupting your attempt to give them money, so some people must be taking the bait.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#147

Earlier quoted context omitted.

IMO web browser have been enabling all sorts of obnoxious behavior since before JS. One of my all time favorites were the sites that opened pop-ups in a loop faster than you could close them while an audio clip of a guy yelling "Hey everyone! I'm looking at gay porn!" You had to hit reset. Fuck the Web.

Opening a popup needs JS though.

Not with the new popover API.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#150

i'd argue that perhaps the ability to play audio should be permission gated, much like the ability to use webcam/microphone. However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to. With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing t…

I would actually love if I could have iOS prompt me to allow certain apps to use the speakers. I hate using an app and suddenly have a video autoplay loudly.

I wish Android had this as well. There are apps where it's difficult-to-impossible to turn all sound off, and I wish I could just tell my phone that this app is just never allowed to use the speakers.
Post reply on HN