Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

Post reply on HN
Print view View original

331–340 of 347 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#331

Post by pteraspidomorph »

yjftsjthsd-h wrote: post #247
pteraspidomorph wrote: post #199

Earlier quoted context omitted.

Also, people can and should go to the firefox settings > Permissions and data > Autoplay and change the Default for all websites to "Block Audio" (at least). You can set per-hostname exceptions if you like! CTRL + I > Permissions

> You can set per-hostname exceptions if you like! CTRL + I > Permissions 1. Thank you, that's very nice to know about. 2. I really wish this was exposed more directly, probably from the permissions button that is already in the address bar. I can't believe Chrome does this better.

You can access page info through address bar shield > connection secure > more site information too. It used to be easier to access from there, but they redesigned that at some point I think.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#332

Post by tomrittervg »

emctech wrote: post #305
tomrittervg wrote: post #262

WebAudio fingerprinting is largely mitigated (in Firefox, potentially other browsers) - I wrote a quick overview that talks about the current distribution of values as well as our more recent efforts. https://ritter.vg/blog-webaudio_alibaba.html

Thanks for your input and perspective! Do you think it is a bug that the muting of the firefox tab doesn't stop the audio stream? It is frustrating that companies would use such an annoying tactic to track their users with it also ineffective.

Yes, it is a bug, in fact it's this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1863193#c9 which is of course getting some more attention now =)

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#333

Post by emctech »

tomrittervg wrote: post #332
emctech wrote: post #305

Earlier quoted context omitted.

Thanks for your input and perspective! Do you think it is a bug that the muting of the firefox tab doesn't stop the audio stream? It is frustrating that companies would use such an annoying tactic to track their users with it also ineffective.

Yes, it is a bug, in fact it's this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1863193#c9 which is of course getting some more attention now =)

Good to know! I have added a note and link to my post.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#334

Post by 63stack »

toasty228 wrote: post #318
63stack wrote: post #35

Earlier quoted context omitted.

This is not about the products that are shipped, but the app itself. I would caution people to never install it as well.

Do you trust the X app? Whatsapp? gmaps? Where do you draw the line? Is it one of these HN usual "ChInA BaD" psychosis ?

In order: no, no, no, and no. I accepted that I can't avoid google spying on me on android, if I could have a phone that works with banking apps without google's crap I would, but thanks to their safetynet racket it's not possible for me.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#335

Post by prmoustache »

HDBaseT wrote: post #287
coldtea wrote: post #265

Earlier quoted context omitted.

So what? I install 0 ecommerce mobile apps. What, I suddenly need to buy Alibaba crap and I can't wait to get to a laptop browser?

You've moved the goal posts there. "Why would anyone install a random app" "Why would anyone use a phone to make a purchase" -- Globally, more than half of all eCommerce purchases are made on a phone or tablet.

> Globally, more than half of all eCommerce purchases are made on a phone or tablet.

The fact that all uneducated crash test dummies are purchasing via dubious apps doesn't mean a seemingly educated population about computer hygiene as I would expect is visiting hn would do that as well.

And it is not about purchasing from mobile, but app vs web browser.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#336

Post by 312c »

doubled112 wrote: post #222
embedding-shape wrote: post #212

Earlier quoted context omitted.

Soon we'll realize that the experience of using reddit (and other mainstream social media) differs a lot based on what country you're in, and sometimes even the state. For example, seemingly a bunch of places in Europe/elsewhere has disabled old.reddit.com unless you're logged in, but seemingly a bunch of people in other places can use it just fine. I'm sure what both of you are seeing is both correct, there is just…

Log in to use old Reddit To keep Reddit safe, accounts are required to access old Reddit. Log in, or continue without an account on reddit.com. First time I've ever seen it. No clear way to bypass it either.

https://www.reddit.com/r/modnews/comments/1ujtebf/logging_in...

It went into effect 2 months ago, there is no bypass for it by design.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#338

Post by sillyboi »

lapcat wrote: post #91
sillyboi wrote: post #75

I thought the App Store review guidelines explicitly prohibit hidden features and using public APIs outside their intended purpose. Is audio-based fingerprinting just not something review can realistically catch?

It's the website. The title of the article literally mentions "WebAudio", and the first paragraph states that the author is using a PC. The second paragraph mentions Chrome and Firefox. Apple and the App Store have zero involvement here.

Right, the article is about the website. I was responding to the comments up there about the iOS app doing the same thing in the background, but I didn't catch the little bit with the reply.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#339

Post by lxgr »

VladVladikoff wrote: post #299
RajT88 wrote: post #245

Earlier quoted context omitted.

Chrome says "this site", no? Isn't it the tab you have in focus? I wonder what kind of person says 'Yes' to this prompt. It gives me the heebie jeebies.

No, it’s a macOS level prompt.

Then it’s most likely Chrome using local network access for WebRTC or Chrome without granting that access to websites without any explicit interaction with camera permissions or cast features.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#340

Post by arendtio »

I wonder how many other websites are doing such stuff. Lately, KDE Plasma often shows me that audio is being played by Firefox, but no tab in Firefox has the speaker icon. So far, I have not found which page causes this issue (I don't use AliExpress).
Post reply on HN