Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

201–210 of 347 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#201

Earlier quoted context omitted.

>Obviously apps can tell if they haven't been granted a permission By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission. In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.

Soundd like a nightmare to build legitimate apps if you for example are building an app that uses the camera but you can’t in anyway tell that using the camera fails (because user had denied the permission 6 months ago and has no memory of it) and instead of being able to give a helpful error you are just ending up with I am guessing fake images (maybe just a black screen).

Just because it's hard doesn't mean you shouldn't try. What about a popup saying "xyz has tried to access the camera a lot lately, continue blocking?"? Or apps can apply for set of 'core permissions' that can't be denied but are much more tightly controlled? Apple and Google are some of the biggest companies in the world, they don't deserve as much leeway as you're offering.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#202
post #145

This sounds like a GDPR issue no? Couldn't they be taken to the EU!

Going batshit with browser APIs is also a formidable GDPR defense. e.g. try browsing the privacy-related forms for Google (https://myaccount.google.com) on Firefox :D (entire browser freezes up every other second for me, because of some extremely important work Google needs to run on my CPU to let me scroll down on a static site containing roughly 30 words)

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#204
post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

The speaker icon would be handy but I think that it depends from both the good will of Firefox and the installed add ons. Of course if an add on blocks the audio file there is no need to display the speaker icon for that file. To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my…

It doesn't actually stream an audio file, the scripts generate audio at runtime using a sawtooth oscillator. It also only happens after several seconds.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#205
post #79

A part of me is always smiling a little inside when people find creative ways to abuse browsers. It's always one more demonstration that the current web is fundamentally broken by design. The distinction between web browsers and random programs that allow remore arbitrary code execution is becoming more and more academic with every new feature that gets exposed to JavaScript. Of course, I am also a horrible hypocrite…

It was a mistake to normalize blindly executing whatever code the server sends your browser. One day we'll look back on this era and wish we had pulled the plug sooner.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#206
post #59

With my previous hearing aid I noticed that visiting a wide variety of web sites would cause a change in the amplification of environmental noise. I always assumed it was doing something with Bluetooth, and probably not for a good reason. This is with an iPhone 13 and one Kirkland/phonak hearing aid. I haven’t noticed this recently, but I also now have two newer Phonak hearing aids and a few iOS updates have happened…

It seems far more likely that your cheap hearing aids are sensitive to certain RF frequencies and the background javascript is causing different patterns of load on the phone's CPU. I would suspect that this only happens when you're charging and it is likely the charger or cable not being properly shielded.

The cheap hearing aid cost $750 for one and is substantially the same as the same thing sold from standalone audiologists for much more. These are not cheap over the counter devices.

Charging only happens while in the cradle, not while worn.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#207
post #200

Earlier quoted context omitted.

Sorry, this is my first post to HN and in the submission it looked like the description text i added would be part of the post header.

Don’t apologize. This was a very fascinating read, and a good technical write up, especially for you first even HN post. It’s not your fault others didn’t look at the username :)

Thanks for the feedback :D

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#208

Earlier quoted context omitted.

The speaker icon would be handy but I think that it depends from both the good will of Firefox and the installed add ons. Of course if an add on blocks the audio file there is no need to display the speaker icon for that file. To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my…

It doesn't actually stream an audio file, the scripts generate audio at runtime using a sawtooth oscillator. It also only happens after several seconds.

Thanks. So one of the downloaded scripts is generating the audio and the browser should detect it.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#209
post #141

Earlier quoted context omitted.

They said they aren't interested

chimed in... thank you for the great documentation!

I am glad people like the write up and it is fostering a conversation! It is such a happenstance that i looked into this.
Post reply on HN