Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

Post reply on HN
Print view View original

271–280 of 346 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#271

Post by numpad0 »

downrightmike wrote: post #174
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue. @FireFoxDudes You need to be addressing fingerprinting

Or just started removing features and debloating the Web standards. We don't need WebCoffeeBeansRoasterGrinder or WebElectricVehicleEmergencyBraking. We should be able to live with a LOT less without graphics, performance, or addictiveness degradation.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#272

Post by farlight »

ornornor wrote: post #125
wongarsu wrote: post #93

Earlier quoted context omitted.

I believe the prices are the same. But the app has a number of "games" to collect tokens that get credited as discounts. Seems to be mostly stuff designed to get you to open the app daily and browse their offers. Which might be "innocent" if it's just to get you to buy more stuff, or maybe they have more reasons they want you to have the app open. Who knows At least Aliexpress doesn't have all the fake slot machine t…

There are few things more scammy than AliExpress “discounts”. I have yet to see a cent of the hundreds of dollars of “savings” they gave or advertised to me.

They used to give 5-10 bucks of credit to new users a few years ago. Real credits, I very carefully compared prices from different IPs.

So I would register a new account for each order -- 10 USD is quite a lot of money in my country -- and saved at least a hundred on buying dev boards and other components.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#273

Post by farlight »

coldtea wrote: post #96
ivanjermakov wrote: post #71

Earlier quoted context omitted.

Not sure if they still do, but a couple years ago prices in the app were lower than on the website. And they promoted installing it to save money.

And someone would install random apps to save $5 on $100 purchases?

Sure. I can live for a day on those five bucks. You wouldn't believe what people in low income countries go through to save a bit of money: I've seen people I know (but couldn't stop in time) send copies of their ID to some shady company to get a five percent discount on gasoline.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#274

Post by IX-103 »

This is actually a really common form of fingerprinting. At one point in time, it could generally tell the website what operating system and CPU architecture you're running on. I know this type of fingerprinting was fixed in Chrome so it always gives the same answers regardless of platform. I think it was also fixed in Firefox and Safari, but I don't follow their releases as closely.

Of course, even though it's probably useless now, things like that hang around because it costs more for trackers to remove the code than it does to keep it in.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#275

Post by ihaveajob »

tgsovlerkhgsel wrote: post #266
ivanjermakov wrote: post #71

Earlier quoted context omitted.

Not sure if they still do, but a couple years ago prices in the app were lower than on the website. And they promoted installing it to save money.

That's how you know you absolutely should not do that. Like a white van with FREE CANDY written on it...

It worked for Reddit... It used to be a 100% website experience and now I'd venture the majority of their traffic is from the mobile app.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#276

Post by john_strinlai »

FuckButtons wrote: post #269
john_strinlai wrote: post #249

Earlier quoted context omitted.

a lot of what is used for fingerprinting is also used legitimately, and a lot of sites fingerprint. so ~every site would be behind a security risk warning. we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored

Presumably the intended outcome would be that sites would be pressured into not being malignant actors with regards to user privacy, rather than everyone just ignoring the security notice.

i understand the intention, and i offered my opinion on what the actual outcome would be.

~every piece of data can be used for fingerprinting. settings and preferences, browser, os, etc. fingerprinting is not its own category of data, it's the correlation of regular data.

the "pressure" ends up being: stop receiving any data at all (which would obviously break ~everything), or put up a warning (leading to fatigue).

consider accessibility settings: absolutely required for some people to browse the internet, but also extremely high-value data for fingerprinting a user.

there is no technical method to know whether a site asking about a visitor's accessibility settings is doing it so that they can properly display content or so that they can fingerprint the visitor. (i.e. there is no "evil bit")

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#278

Post by nazgulsenpai »

> screen and viewport dimensions

I remember trying I think it was the Tor browser, being puzzled at why the viewable area of the window constantly changed when resized but would never occupy the full window.

I feel a little silly now.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#280

Post by announcer4614 »

VladVladikoff wrote: post #223
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.

Are you running PiHole, Adguard or similar and using macOS? On macOS, Chrome treats 0.0.0.0 as a local address which results in these prompts. Switching to having blocked domains return NXDOMAIN can work around the issue.
Post reply on HN