Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

Post reply on HN
Print view View original

241–250 of 347 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#241

Post by dylan604 »

ryandrake wrote: post #185
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period. Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.

I do not have the Zoom app in any form installed. I'd much rather use it in the browser. When I close the tab, Zoom is gone. After the COVID era bullshit of Zoom installing a utility that gives root access to anything, I've never installed it. Luckily, all of that came out before I started using Zoom.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#242

Post by crossroadsguy »

jusssi wrote: post #137
lukeify wrote: post #9

Earlier quoted context omitted.

I cannot ever imagine installing something like AliExpress as an app.

A lot of people install TikTok. Or Instagram.

Or Claude/etc on their personal computers and then even live dangerously.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#243

Post by ajross »

drdexebtjl wrote: post #236
ajross wrote: post #85

Earlier quoted context omitted.

That does nothing but start an arms race. Fine, audio "works" but do you get noise? Can you read back the sounds you play? No, right? It doesn't work, QED. Now the platform needs to fake the noise. Likewise for any other hardware access you want, and most of them are harder. How do you fake local storage without storing anything? How do you fake Bluetooth access without virtualizing an entire device? Do you fake the…

> Can you read back the sounds you play? No, but you also can’t do that if the user approves your app’s permission to play audio, but has the volume permanently turned down to zero. > local storage Give the app a temporary, space-constrained store that isn’t shared with other apps. > bluetooth Don’t let apps access raw bluetooth signals, but instead ask the platform to display a pairing interface (possibly with a cus…

> This isn’t a war

Fingerprinting and other quasi-malware techniques being used by desirable third party software are absolutely a war, otherwise we wouldn't have this permission structure in place in the first place. And as much as you believe the contrary, Alibaba et. al. are 100% smarter than you about how to exploit these tricks and will win.

> Not personal data.

LOL

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#244

Post by mgerdts »

retrac wrote: post #218
mgerdts wrote: post #59

With my previous hearing aid I noticed that visiting a wide variety of web sites would cause a change in the amplification of environmental noise. I always assumed it was doing something with Bluetooth, and probably not for a good reason. This is with an iPhone 13 and one Kirkland/phonak hearing aid. I haven’t noticed this recently, but I also now have two newer Phonak hearing aids and a few iOS updates have happened…

It's the Bluetooth; when Bluetooth connects most hearing aids reduce the environmental volume slightly so you can hear the streaming content. Some app has started to play audio (perhaps silently). I notice it on some websites. How much HAs reduce environmental sounds when streaming is configurable by the way, but only by the audiologist if you don't have your own programmer. I don't like the effect and prefer to just…

Is this tunable per hearing program? When in an even moderately noisy environment I find myself switching to AirPods if I’m streaming. I would love for the HA to give separate controls for BT audio vs ambient like AirPods do.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#245

Post by RajT88 »

VladVladikoff wrote: post #223
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.

Chrome says "this site", no? Isn't it the tab you have in focus?

I wonder what kind of person says 'Yes' to this prompt. It gives me the heebie jeebies.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#246

Post by lxgr »

VladVladikoff wrote: post #223
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.

Any chance it was a macOS prompt? Chrome needs local network permissions for WebRTC, Cast etc. even without any website accessing your local network.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#247

Post by yjftsjthsd-h »

pteraspidomorph wrote: post #199
lxgr wrote: post #194

Earlier quoted context omitted.

This issue is about audio output. Audio and video input are both behind per-site permissions.

Also, people can and should go to the firefox settings > Permissions and data > Autoplay and change the Default for all websites to "Block Audio" (at least). You can set per-hostname exceptions if you like! CTRL + I > Permissions

> You can set per-hostname exceptions if you like! CTRL + I > Permissions

1. Thank you, that's very nice to know about.

2. I really wish this was exposed more directly, probably from the permissions button that is already in the address bar. I can't believe Chrome does this better.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#248

Post by RajT88 »

mohaine wrote: post #240
VladVladikoff wrote: post #223

Earlier quoted context omitted.

Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.

pretty sure it is a way of fingerprinting your machine/network

Let's hope it's as simple as that and not a malvertising campaign.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#249

Post by john_strinlai »

downrightmike wrote: post #174
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue. @FireFoxDudes You need to be addressing fingerprinting

a lot of what is used for fingerprinting is also used legitimately, and a lot of sites fingerprint. so ~every site would be behind a security risk warning.

we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#250

Post by gaudystead »

emctech wrote: post #164
big_dave212 wrote: post #154

Trying to debug this as a normal user is basically hopeless, you would never think to suspect a shopping tab. Glad someone did the legwork.

It just annoyed me so much that it was interrupting my music!

Hell hath no fury like an inconvenienced power user.
Post reply on HN