Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

Post reply on HN
Print view View original

231–240 of 347 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#231

Post by bartread »

VladVladikoff wrote: post #223
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.

Yeah, that’s always an automatic nope. No explanation of who/what is really asking or why so, no: your shit software or website can’t go snooping around on whatever network I happen to be on, whether that’s at home or at work.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#232

Post by stevecoalbear »

lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

It should instead trigger a little germ icon, like a virus, because it's like a virus.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#235

Post by soulofmischief »

pteraspidomorph wrote: post #199
lxgr wrote: post #194

Earlier quoted context omitted.

This issue is about audio output. Audio and video input are both behind per-site permissions.

Also, people can and should go to the firefox settings > Permissions and data > Autoplay and change the Default for all websites to "Block Audio" (at least). You can set per-hostname exceptions if you like! CTRL + I > Permissions

Unfortunately that still gives another data point for fingerprinting.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#236

Post by drdexebtjl »

ajross wrote: post #85
drdexebtjl wrote: post #72

Earlier quoted context omitted.

>Obviously apps can tell if they haven't been granted a permission By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission. In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.

That does nothing but start an arms race. Fine, audio "works" but do you get noise? Can you read back the sounds you play? No, right? It doesn't work, QED. Now the platform needs to fake the noise. Likewise for any other hardware access you want, and most of them are harder. How do you fake local storage without storing anything? How do you fake Bluetooth access without virtualizing an entire device? Do you fake the…

> Can you read back the sounds you play?

No, but you also can’t do that if the user approves your app’s permission to play audio, but has the volume permanently turned down to zero.

> local storage

Give the app a temporary, space-constrained store that isn’t shared with other apps.

> bluetooth

Don’t let apps access raw bluetooth signals, but instead ask the platform to display a pairing interface (possibly with a custom stylesheet), ask the platform to call you back when a specific device is in range, etc.

> screen dimensions

Not personal data.

> input latency

Fudge the numbers even when the user grants permission.

This isn’t a war, it’s just engineering for the benefit and autonomy of the user, and not the platforms’ commercial interests.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#237

Post by BoorishBears »

mgerdts wrote: post #59

With my previous hearing aid I noticed that visiting a wide variety of web sites would cause a change in the amplification of environmental noise. I always assumed it was doing something with Bluetooth, and probably not for a good reason. This is with an iPhone 13 and one Kirkland/phonak hearing aid. I haven’t noticed this recently, but I also now have two newer Phonak hearing aids and a few iOS updates have happened…

I noticed my MBP had a periodic stutter sometimes: every 3 seconds or so the mouse would lock up for a few milliseconds.

I tracked it down to American Express's login page (auto loads if you leave the site idle) relying on Akamai's anti bot measures polling some web Bluetooth feature, causing Chrome to trigger a BT scan: https://castle.io/research/fingerprint-harvesting-in-the-bot...

Turning off Bluetooth solves it, but that's not a great solution when using a Bluetooth mouse... and it sounds like it might be causing your issue too.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#238

Post by nozzlegear »

grishka wrote: post #219
nozzlegear wrote: post #147

Earlier quoted context omitted.

Not with the new popover API.

This doesn't look like it gives websites something they couldn't do before with CSS and JS.

I'm pretty sure it does but maybe I'm wrong, I had never tried to create popovers/popups using CSS. What's neat[†] about the popovers API is that it doesn't need any JS, you just write a couple of HTML attributes and voila, a popover/popup. They will run with JS disabled as well.

https://chrisburnell.com/html-can-do-that/

[†] Neat for me building things like tooltips and dropdowns into my web apps without using JS; not neat for annoying people with popups.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#239

Post by chrisjj »

emctech wrote: post #112
left-struck wrote: post #110

Earlier quoted context omitted.

You should make that obvious in some way like using “TLDR”. I assume many people, like me, would attempt to parse your comment as a comment on the article, after all it’s in the comment section, and read that way it’s very confusing lol.

Sorry, this is my first post to HN and in the submission it looked like the description text i added would be part of the post header.

HN's fault entirely. The post form's actioning "text" as a comment is remiss.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#240

Post by mohaine »

VladVladikoff wrote: post #223
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.

pretty sure it is a way of fingerprinting your machine/network
Post reply on HN