Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

Post reply on HN
Print view View original

61–70 of 349 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#61

Post by CTDOCodebases »

emctech wrote: post #12
CTDOCodebases wrote: post #11

They have been doing this for months. No sound playing but the audio would change like the microphone was being activated. I checked permissions to make sure there was no mic access and figured that they were fingerprinting.

I had noticed it before but I was browsing AE a lot today and i got fed up with it. What browser and OS are you using?

It was happening when I was using Chrome on iPhone and Windows 11 with Chrome. I can't remember what was causing it since the headphones (Bose Quietcomfort SE) are synced with both devices. For the last couple of months I've been using Android and I haven't noticed it. The headphones seem to work better with Android. IOS is a bit weird with sharing them with my PC.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#62

Post by ibaikov »

I had this (?) happen. I have a soundbar hooked up through spdif in my pc. It automatically switches sources, so I can play music through airplay and then have it play sounds from pc when I open youtube etc. So it switches from airplay music to pc even when nothing is playing on pc. This was happening on some websites and it is extremely annoying.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#63

Post by ajross »

pyaamb wrote: post #60

Need to rethink the system that allows for (and encourages) this kind of plausible deniability. From "Oh we need this permission for [non essential feature] and you need to accept it if you want the app at all" -> to giving the user ultimate control over what happens on their personal device. Virtualize what the app can see and use fake data/identifiers/devices if necessary to get it to do what its supposed to. If th…

What you want is basically how it works. On both phone platforms and PWAs, all permissions are visible to the user explicitly. All of them can be revoked at any time. Apps are disallowed from requesting an already-denied permission.

Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party software isn't under any obligation to work without them.

But the platforms have done what the platforms can do, at the architecture side, really. The next stage is human-audited enforcement of malware, which this AliExpress nonsense might hopefully run afoul of.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#65

Post by y-curious »

emctech wrote: post #7
compsciphd wrote: post #6

i'd argue that perhaps the ability to play audio should be permission gated, much like the ability to use webcam/microphone. However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to. With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing t…

The ability to play audio can usually be permission gated with tab muting, however the methods aliexpress use bypass that mechanism completely.

This is the part you should be highlighting aggressively. That’s very uncomfortable

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#66

Post by xnx »

ajross wrote: post #63
pyaamb wrote: post #60

Need to rethink the system that allows for (and encourages) this kind of plausible deniability. From "Oh we need this permission for [non essential feature] and you need to accept it if you want the app at all" -> to giving the user ultimate control over what happens on their personal device. Virtualize what the app can see and use fake data/identifiers/devices if necessary to get it to do what its supposed to. If th…

What you want is basically how it works. On both phone platforms and PWAs, all permissions are visible to the user explicitly. All of them can be revoked at any time. Apps are disallowed from requesting an already-denied permission. Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party softwa…

> Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working),

How can they tell? For the permissions I can think of: location, filesystem, etc. it should be easy to lie/spoof.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#67

Post by mark_something »

lovestory wrote: post #34
lukeify wrote: post #9

Earlier quoted context omitted.

I cannot ever imagine installing something like AliExpress as an app.

You probably buy things off amazon that are dropshipped from AliExpress all the time. Stop with the elitism

On AliExpress I see things like 64 TB (no, not GB!) USB flash drives for less than 10 euro, obviously a scam. I also see less spectacular products but still good looking deals, but without a brand name so you can't search the web for reviews.

On Amazon I never see products like that. That's why I prefer Amazon (and Coolblue and bol.com in Belgium).

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#68

Post by echoangle »

ngl999 wrote: post #14
patspam wrote: post #8

I noticed in the last few weeks that if I’d recently opened the AliExpress iOS app (ie. it was backgrounded) my car audio would freak out thinking I was giving it an audio command. Killing the AliExpress app immediately fixed the problem. After seeing it happen more than once I assumed it was something dodgey and uninstalled the app.

It's known that some Chinese mobile apps employ this trick to keep the app alive in the background, the rumor is that this way the 'active user' KPI can be better met. edit: quantity qualifier

Why would they manipulate the numbers that way if it’s self-reported anyways? If you want to fake the numbers, couldn’t you just change the number and be done?

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#69

Post by kees99 »

mark_something wrote: post #67
lovestory wrote: post #34

Earlier quoted context omitted.

You probably buy things off amazon that are dropshipped from AliExpress all the time. Stop with the elitism

On AliExpress I see things like 64 TB (no, not GB!) USB flash drives for less than 10 euro, obviously a scam. I also see less spectacular products but still good looking deals, but without a brand name so you can't search the web for reviews. On Amazon I never see products like that. That's why I prefer Amazon (and Coolblue and bol.com in Belgium).

Few years back, Amazon had a rampant "fake USB storage" problem too. Then, one day, all the fakes were gone, just like that.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#70

Post by AstralSerenity »

manbash wrote: post #55
dogman1050 wrote: post #29

Earlier quoted context omitted.

I have Prime, but I can't imagine installing the Amazon app either. The website works just fine.

With Firefox, yes. I wouldn't fully trust other browsers to care about my privacy.

Using web apps on Firefox really is the way given its support for uBlock Origin.

Screen real estate is precious on phones, so being able to permanently block "Install our app!" and even entire navigation categories (shorts on LinkedIn) is quite valuable.

Then you can "install" the site on your home screen or simply place it in collection folders so it's sitting ready on your "New Tab" page.

Post reply on HN