Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

Post reply on HN
Print view View original

281–290 of 347 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#281

Post by whstl »

deepsun wrote: post #177
whstl wrote: post #48

Earlier quoted context omitted.

So they're pulling a Reddit, basically. "The app is great because the website is heavily degraded".

Reddit is fine, just a small popup at the bottom. Facebook kn the other hand turned off most functions on mobile, e.g. chat. Good thing though if you don't use the chat long enough, friends start using other means of communication.

Haha, yeah. Reddit for the longest time hasn't allowed me to browse certain subreddits without the app. I basically ignore search results from it.

As the sibling poster mentioned, might depend on location, but it DOES happen.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#283

Post by nntwozz »

woadwarrior01 wrote: post #83
nntwozz wrote: post #36

Earlier quoted context omitted.

This is the way. It's prudent to treat apps with skepticism, it's unfortunate it's come to this. I study Apple's Privacy Nutrition Labels religiously every time I consider installing an app. I like the ones with "Data Not Collected".

I'm an app developer and all my apps have the "Data Not Collected" privacy nutrition label. I love the idea, but Apple's enforcement of it is very lackadaisical. I've reported dozens of apps that were blatantly lying on their privacy nutrition labels to Apple and I'm yet to see any such app's nutrition label change. Here's a good overview of the problem: https://arxiv.org/abs/2206.02658v3

Oh man… that's a rude awakening.

I can't help but feel the whole Apple privacy PR will be blown in the future where some report will come out that Apple has been logging and sharing user data with NSA since 2001.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#284

Post by pxoe »

ryandrake wrote: post #185
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period. Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.

They don't "just hand over access". If anything, browsers pioneered permissions for mic and camera on desktops, having them several years earlier before windows even got around to having these things restricted under permissions.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#286

Post by HDBaseT »

myself248 wrote: post #221
nubinetwork wrote: post #188

Earlier quoted context omitted.

It does on my Firefox, I had to close their tab because it also tricks kde into thinking I'm playing audio.

Thaaaaaaat explains why an open Aliexpress tab always bumps my thermals ever so slightly.

What?

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#287

Post by HDBaseT »

coldtea wrote: post #265
fckgw wrote: post #136

Earlier quoted context omitted.

"random apps" and it's the largest eCommerce company on the planet

So what? I install 0 ecommerce mobile apps. What, I suddenly need to buy Alibaba crap and I can't wait to get to a laptop browser?

You've moved the goal posts there.

"Why would anyone install a random app"

"Why would anyone use a phone to make a purchase"

--

Globally, more than half of all eCommerce purchases are made on a phone or tablet.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#288

Post by javier2 »

VladVladikoff wrote: post #223
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.

usually its scanning for chromecasts on the local network, but could be other things as well

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#289

Post by derefr »

VladVladikoff wrote: post #223
lxgr wrote: post #157

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content... Now I wonder, does this also allow websites to c…

Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.

I would note that if you say no to this, not only automatic but also explicit top-level navigation to “local network” locations (e.g. localhost, 192.168.1.x, etc) will be denied. Kind of annoying when you don’t want Chrome exploring your network, yet still need to regularly e.g. access your NAS web dashboard.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#290

Post by drdexebtjl »

ajross wrote: post #243
drdexebtjl wrote: post #236

Earlier quoted context omitted.

> Can you read back the sounds you play? No, but you also can’t do that if the user approves your app’s permission to play audio, but has the volume permanently turned down to zero. > local storage Give the app a temporary, space-constrained store that isn’t shared with other apps. > bluetooth Don’t let apps access raw bluetooth signals, but instead ask the platform to display a pairing interface (possibly with a cus…

> This isn’t a war Fingerprinting and other quasi-malware techniques being used by desirable third party software are absolutely a war, otherwise we wouldn't have this permission structure in place in the first place. And as much as you believe the contrary, Alibaba et. al. are 100% smarter than you about how to exploit these tricks and will win. > Not personal data. LOL

I don’t appreciate the personal attack. You don’t know me.

Permissions have nothing to do with preventing fingerprinting, they have to do with user control. Every permission you add that the app can inspect is one extra bit of fingerprint, so it’s actually worse.

In TFA’s case, if the app was simply not hooked up to an actual audio sink, they would still be able to use this mechanism for fingerprinting, since it’s the processing pipeline itself that leaves the fingerprint.

Note that the article isn’t calling out for fingerprinting specifically. I’m sure AliExpress does more fingerprinting than this. The problem is specifically that they’re interfering with multipoint Bluetooth audio.

Post reply on HN