Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

Post reply on HN
Print view View original

301–310 of 348 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#301

Post by Rohansi »

mywittyname wrote: post #263
dylan604 wrote: post #241

Earlier quoted context omitted.

I do not have the Zoom app in any form installed. I'd much rather use it in the browser. When I close the tab, Zoom is gone. After the COVID era bullshit of Zoom installing a utility that gives root access to anything, I've never installed it. Luckily, all of that came out before I started using Zoom.

There's a solution to both: 1. Not make web browser general-purpose runtimes for arbitrary software. 2. OS builds a general-purposes runtime that's completely sandboxed. So users can run more complex software without needing to worry about cruft being installed on their system. Unfortunately, browser builders have decided that web browsers are #2.

What is the practical difference if the OS provides your general-purpose sandboxed runtime instead of the browser? The browser is already a product being developed by the same organization as the OS for a significant chunk of people.

iOS -> Safari

Android -> Chrome

Windows -> Edge (based on Chromium, so fixes in Edge make their way into Chrome too)

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#302

Post by like_any_other »

Getting a list of emails from a website by guessing a predictable ID gets your house raided by the FBI and a criminal conviction for accessing a computer without authorization [1]. Why isn't fingerprinting treated the same? And I mean exactly the same - first an FBI raid, arrest, and confiscation of computers, and then they get their day in court.

[1] https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_emai...

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#303

Post by VladVladikoff »

announcer4614 wrote: post #280
VladVladikoff wrote: post #223

Earlier quoted context omitted.

Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.

Are you running PiHole, Adguard or similar and using macOS? On macOS, Chrome treats 0.0.0.0 as a local address which results in these prompts. Switching to having blocked domains return NXDOMAIN can work around the issue.

Thanks! Could be AdGuard!

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#304

Post by sebastiennight »

john_strinlai wrote: post #276
FuckButtons wrote: post #269

Earlier quoted context omitted.

Presumably the intended outcome would be that sites would be pressured into not being malignant actors with regards to user privacy, rather than everyone just ignoring the security notice.

i understand the intention, and i offered my opinion on what the actual outcome would be. ~every piece of data can be used for fingerprinting. settings and preferences, browser, os, etc. fingerprinting is not its own category of data, it's the correlation of regular data. the "pressure" ends up being: stop receiving any data at all (which would obviously break ~everything), or put up a warning (leading to fatigue). c…

> there is no "evil bit"

There's always been one, but it's been defaulting to 1 ever since the Web 2.0 upgrade, and the API to set it back to 0 has been deprecated.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#305

Post by emctech »

tomrittervg wrote: post #262

WebAudio fingerprinting is largely mitigated (in Firefox, potentially other browsers) - I wrote a quick overview that talks about the current distribution of values as well as our more recent efforts. https://ritter.vg/blog-webaudio_alibaba.html

Thanks for your input and perspective! Do you think it is a bug that the muting of the firefox tab doesn't stop the audio stream? It is frustrating that companies would use such an annoying tactic to track their users with it also ineffective.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#306

Post by emctech »

like_any_other wrote: post #302

Getting a list of emails from a website by guessing a predictable ID gets your house raided by the FBI and a criminal conviction for accessing a computer without authorization [1]. Why isn't fingerprinting treated the same? And I mean exactly the same - first an FBI raid, arrest, and confiscation of computers, and then they get their day in court. [1] https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_emai...

I doubt the FBI will be flying to china to knock down any doors! You aren't wrong though, and countries which enforce GDPR I would expect to make noise if this was happening to their constituents.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#308

Post by Lio »

doubled112 wrote: post #222
embedding-shape wrote: post #212

Earlier quoted context omitted.

Soon we'll realize that the experience of using reddit (and other mainstream social media) differs a lot based on what country you're in, and sometimes even the state. For example, seemingly a bunch of places in Europe/elsewhere has disabled old.reddit.com unless you're logged in, but seemingly a bunch of people in other places can use it just fine. I'm sure what both of you are seeing is both correct, there is just…

Log in to use old Reddit To keep Reddit safe, accounts are required to access old Reddit. Log in, or continue without an account on reddit.com. First time I've ever seen it. No clear way to bypass it either.

I think it’s a push for either more tracking through login or to push people to more addictive features like endless scrolling and autoplaying videos.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#309

Post by Lio »

ohyoutravel wrote: post #39
lovestory wrote: post #34

Earlier quoted context omitted.

You probably buy things off amazon that are dropshipped from AliExpress all the time. Stop with the elitism

Love Temu and AliExpress for specialized components at dirt cheap prices. I would never, ever install their app. Ever, security nightmare. Similar to how I use Amazon Prime but would never order something I ingest, put on my skin, or (usually) wear from it. Not elitest.

I would never use Temu for anything.

Elitism has nothing to do with refusing to buy products made with slavery.

A lot of people are critical of historic slavery whilst happily buying from Temu. That’s scummy as hell.

https://www.bbc.co.uk/news/business-67752413

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#310

Post by michaelt »

lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

> I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content

When most sites do browser fingerprinting using audio, they use an 'OfflineAudioContext' - which unlike a normal AudioContext, doesn't run in real time and send its output to system's loudspeakers; instead, it runs faster-than-real-time and outputs to an AudioBuffer. So the browser can easily tell no sound is being played.

For example - you can tell the browser to create a 10kHz square wave, feed it to a GainNode then a DynamicsCompressorNode, output to a buffer, then hash the contents of that buffer - which gives you a browser fingerprint, because of subtle differences between browsers.

Post reply on HN