Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

341–347 of 347 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#341
post #246

Earlier quoted context omitted.

Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.

Any chance it was a macOS prompt? Chrome needs local network permissions for WebRTC, Cast etc. even without any website accessing your local network.

It is most likely this: https://wicg.github.io/local-network-access/

For a while there's been an anti-pattern where a piece of software leaves a localhost daemon running (often without proper security) for web integration.

One of the more famous abusers was Zoom: https://infosecwriteups.com/zoom-zero-day-4-million-webcams-...

XSRF vulns also have existed where e.g. a web page can blinding attempt to hit your router's page to change your DNS servers by knowing common router admin sites and default home network topologies. This isn't as useful in today's HTTPS world.

Browsers have been adding more partitioning between local and internet resources to prevent this sort of thing. But that does mean simply putting localhost entries in a hosts file to blackhole a site can now cause an issue.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#342

Earlier quoted context omitted.

It doesn't actually stream an audio file, the scripts generate audio at runtime using a sawtooth oscillator. It also only happens after several seconds.

Thanks. So one of the downloaded scripts is generating the audio and the browser should detect it.

So what's the current usable fork of uMatrix nowadays?

Switched from NoScript in the days of 'HttpSwitchboard', then over to uMatrix, but using uBo only now.

Still missing some elements of uMatrix, though.

How does it work with uBo now? Where does it interfere? What are the redundancies to check for, and letting only uMatrix(whichever fork) handle it? What to disable in uBo for it to work effectively?

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#343
post #55

Earlier quoted context omitted.

With Firefox, yes. I wouldn't fully trust other browsers to care about my privacy.

Firefox the privacy browser that is directly selling all its users searches to Google for decades? Not to mention all its other build in telemetry and ads. If you want an actual private Firefox Browser use a fork like Mullvad Browser, LibreWolf and Tor Browser.

Mozilla with Firefox does not sell and does not have ads. You have downloaded a modified spyware version or have convonced yourself that this is true due to a bad dream. Take more care online is my advice yo you and don't spread false information either.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#345

Earlier quoted context omitted.

Thanks. So one of the downloaded scripts is generating the audio and the browser should detect it.

So what's the current usable fork of uMatrix nowadays? Switched from NoScript in the days of 'HttpSwitchboard', then over to uMatrix, but using uBo only now. Still missing some elements of uMatrix, though. How does it work with uBo now? Where does it interfere? What are the redundancies to check for, and letting only uMatrix(whichever fork) handle it? What to disable in uBo for it to work effectively?

I'm using uMatrix. Works fine for me.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#347

Earlier quoted context omitted.

Firefox the privacy browser that is directly selling all its users searches to Google for decades? Not to mention all its other build in telemetry and ads. If you want an actual private Firefox Browser use a fork like Mullvad Browser, LibreWolf and Tor Browser.

Mozilla with Firefox does not sell and does not have ads. You have downloaded a modified spyware version or have convonced yourself that this is true due to a bad dream. Take more care online is my advice yo you and don't spread false information either.

>Mozilla with Firefox does not sell and does not have ads.

https://support.mozilla.org/en-US/kb/sponsor-privacy

https://blog.mozilla.org/en/mozilla/mozilla-and-google-sign-...

The only one trying to convince themselves is you...

Post reply on HN