Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

Post reply on HN
Print view View original

191–200 of 348 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#191

Post by emctech »

lxgr wrote: post #178
emctech wrote: post #169

Earlier quoted context omitted.

I wonder if it is something firefox and chrome devs need to look at because if it is accessing the audio device surely it should be notified to the user.

As I mentioned, I suspect that this is an active choice, as just displaying the icon whenever a media context exists seems much easier than inspecting the audio stream for non-zero volume media. I can only assume that there are legitimate reasons for this as well, e.g. websites preparing/maintaining audio context for lower latency when they intermittently play audio etc.

Someone else mentioned that cloudflare uses the webaudio for verification challenge, but only triggers it briefly.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#192

Post by lxgr »

emctech wrote: post #191
lxgr wrote: post #178

Earlier quoted context omitted.

As I mentioned, I suspect that this is an active choice, as just displaying the icon whenever a media context exists seems much easier than inspecting the audio stream for non-zero volume media. I can only assume that there are legitimate reasons for this as well, e.g. websites preparing/maintaining audio context for lower latency when they intermittently play audio etc.

Someone else mentioned that cloudflare uses the webaudio for verification challenge, but only triggers it briefly.

Ugh... Seems like we need an audio API web permission, or maybe do something like browser already do for some of the other APIs and actually require API users to actually play something or display a warning/play an annoying chime otherwise.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#193

Post by bigbuppo »

miki_oomiri wrote: post #187
downrightmike wrote: post #174

Earlier quoted context omitted.

I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue. @FireFoxDudes You need to be addressing fingerprinting

How? How would a browser "know" what classifies as finger printing? Literally every piece of the engine is used for finger printing. It can be mitigated, a bit, but I don't see how browsers can win that battle. Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).

Just assume any site using javascript is using it for nefarious purposes.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#194

Post by lxgr »

ryandrake wrote: post #185
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period. Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.

This issue is about audio output. Audio and video input are both behind per-site permissions.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#195

Post by [deleted] »

emctech wrote: post #112
left-struck wrote: post #110

Earlier quoted context omitted.

You should make that obvious in some way like using “TLDR”. I assume many people, like me, would attempt to parse your comment as a comment on the article, after all it’s in the comment section, and read that way it’s very confusing lol.

Sorry, this is my first post to HN and in the submission it looked like the description text i added would be part of the post header.

[deleted]

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#196

Post by pmontra »

lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

The speaker icon would be handy but I think that it depends from both the good will of Firefox and the installed add ons. Of course if an add on blocks the audio file there is no need to display the speaker icon for that file.

To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my Android phone. It shows a number of sites. Nothing in first party and these that I must fully enable to make the site work (css, image, script, xhr)

* aliexpress.com

* ase.aliexpress.com

* it.aliexpress.com (my country two letters domain)

* umdc-global.aliexpress.com

* aidcgroup.net

* ase.aidcgroup.net

* 67372.ase.aidcgroup.net

* alibaba-inc.com

* epss.alibaba-inc.com

* alicdn.com

* ae01.alicdn.com

* assets.alicdn.com

* aliexpress-media.com

* ae-pic-a1.aliexpress-media.com

* assets.aliexpress-media.com

* aliyun.com

* acjs.aliyun.com

Scary list, right? According to google aidcroup is

> Alibaba International IPP Platform

> https://ipp.aidcgroup.net

> Alibaba International is committed to the protection of intellectual property rights. Right holders and their agents can enforce intellectual property ...

Let me add a /s to the last line

There are two more sites that I can completely block

* googlesyndication.com

* pagead2.googlesyndication.com

so even Alibaba runs ads on Google.

I did not instrument the browser like the author of the post did, so I don't know where the audio comes from. There is nothing listed in the media column of uMatrix. This does not mean that the post is inaccurate. It could be that the browser gets the audio stream from a request in one of the other categories.

uBlockOrigin blocks two of other requests.

1. https://g.alicdn.com/code/npm/@ali/gmod-pop-disclosure-code/...

and this one that I anonymize

2. https://aplus.aliexpress.com/g.gif?logtype=0&title=WebPush Permission&pre=https://it.aliexpress.com/?gatewayAdapt=glo2ita&scr=1920x1080&_p_url=https://it.aliexpress.com/wp.html&cna=&category=&aplus=&$${beacon_mini}$$=&yunid=&=&trid=&asid=$${get_sign}$$&p=1&o=linux&b=firefox153&s=1920x1080&w=gecko&ism=other&cache=&lver=8.15.25&jsver=aplus_std&pver=0.7.12&_pw=0&_ph=0&tag=1&stag=-1&lstag=-1&_slog=0

Probably the audio file is coming from one of the unblocked requests but my Debian laptop does not pair with my Bluetooth earpieces so I can't test it.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#197

Post by 40four »

left-struck wrote: post #110
emctech wrote: post #56

Earlier quoted context omitted.

No, I took the first sentence of my article and then edited the rest of the intro + conclusion to keep it short for HN.

You should make that obvious in some way like using “TLDR”. I assume many people, like me, would attempt to parse your comment as a comment on the article, after all it’s in the comment section, and read that way it’s very confusing lol.

They shouldn’t have to make it “obvious”. They are the actual author of the article. It’s not their fault you didn’t double check the usernames. It’s not uncommon for authors to comment on their own articles.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#198

Post by 40four »

maximilianthe1 wrote: post #50
emctech wrote: post #2

Recently I ran into a problem with my Bluetooth headphones. They support multipoint bluetooth audio, so they can be connected to my PC and phone at the same time. Opening the Aliexpress webpage causes a silent audio stream keeping the PC>headphone link active blocking my phone audio. An investigation reveals obfuscated code running device fingerprinting with a side effect being a silent audio stream that firefox, chr…

Is this an AI summary of the article?

No you are talking to the actual author of the article. It’s not weird for the author to comment on their own article

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#199

Post by pteraspidomorph »

lxgr wrote: post #194
ryandrake wrote: post #185

Earlier quoted context omitted.

It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period. Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.

This issue is about audio output. Audio and video input are both behind per-site permissions.

Also, people can and should go to the firefox settings > Permissions and data > Autoplay and change the Default for all websites to "Block Audio" (at least).

You can set per-hostname exceptions if you like! CTRL + I > Permissions

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#200

Post by 40four »

emctech wrote: post #112
left-struck wrote: post #110

Earlier quoted context omitted.

You should make that obvious in some way like using “TLDR”. I assume many people, like me, would attempt to parse your comment as a comment on the article, after all it’s in the comment section, and read that way it’s very confusing lol.

Sorry, this is my first post to HN and in the submission it looked like the description text i added would be part of the post header.

Don’t apologize. This was a very fascinating read, and a good technical write up, especially for you first even HN post. It’s not your fault others didn’t look at the username :)
Post reply on HN