Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

Post reply on HN
Print view View original

181–190 of 348 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#181

Post by kccqzy »

rcruzeiro wrote: post #46
compsciphd wrote: post #6

i'd argue that perhaps the ability to play audio should be permission gated, much like the ability to use webcam/microphone. However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to. With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing t…

I would actually love if I could have iOS prompt me to allow certain apps to use the speakers. I hate using an app and suddenly have a video autoplay loudly.

Inside iOS accessibility settings you can turn off “auto-play video previews.” This blocks perhaps 20% of video autoplay; it’s still better than nothing.

Philosophically I hate silent video autoplays just as much as I hate autoplays with audio. One distracts your visual attention, the other distracts your aural attention, and I don’t quite understand why society has normalized silent video autoplay.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#182

Post by KennyBlanken »

ssl-3 wrote: post #162
imzadi wrote: post #135

Earlier quoted context omitted.

I get email updates but whenever I click the track link it tells me I need the app.

I have a package on the way with AliExpress. It is headed from somewhere in China to somewhere in the US. Using my computer just now, I looked at one of the emails that AliExpress sent about this order. It had a clickable tracking number displayed; I clicked it. That brought me to their website, where I landed on a page that included the last update for my order and also a link to "View Details". That works for me. I…

Many sites will work fine in a desktop browser but refuse to do anything in a mobile browser, demanding you install their app or just immediately redirecting you to the iOS or Android app store.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#185

Post by ryandrake »

lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period.

Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#187

Post by miki_oomiri »

downrightmike wrote: post #174
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue. @FireFoxDudes You need to be addressing fingerprinting

How? How would a browser "know" what classifies as finger printing? Literally every piece of the engine is used for finger printing.

It can be mitigated, a bit, but I don't see how browsers can win that battle.

Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#188

Post by nubinetwork »

lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

It does on my Firefox, I had to close their tab because it also tricks kde into thinking I'm playing audio.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#189

Post by pudgywalsh »

deepsun wrote: post #177
whstl wrote: post #48

Earlier quoted context omitted.

So they're pulling a Reddit, basically. "The app is great because the website is heavily degraded".

Reddit is fine, just a small popup at the bottom. Facebook kn the other hand turned off most functions on mobile, e.g. chat. Good thing though if you don't use the chat long enough, friends start using other means of communication.

Reddit is NOT FINE. They throw up full page modals now telling you to continue in the app.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#190

Post by lxgr »

miki_oomiri wrote: post #187
downrightmike wrote: post #174

Earlier quoted context omitted.

I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue. @FireFoxDudes You need to be addressing fingerprinting

How? How would a browser "know" what classifies as finger printing? Literally every piece of the engine is used for finger printing. It can be mitigated, a bit, but I don't see how browsers can win that battle. Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).

I feel like there are two levels of fingerprinting here, and a lot of the confusion is downstream of not properly distinguishing them:

There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc.

I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.

Post reply on HN