Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

Post reply on HN
Print view View original

81–90 of 347 posts

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#81

Post by rigrassm »

ivanjermakov wrote: post #71
lukeify wrote: post #9

Earlier quoted context omitted.

I cannot ever imagine installing something like AliExpress as an app.

Not sure if they still do, but a couple years ago prices in the app were lower than on the website. And they promoted installing it to save money.

> Not sure if they still do, but a couple years ago prices in app were lower than on the website. And they promoted installing it to save money.

Translation: They are able to mine your personal data more completely with an app installed vs the website which they can sell for pure profit. They promoted installing it to extract more value from you.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#83

Post by woadwarrior01 »

nntwozz wrote: post #36
dogman1050 wrote: post #29

Earlier quoted context omitted.

I have Prime, but I can't imagine installing the Amazon app either. The website works just fine.

This is the way. It's prudent to treat apps with skepticism, it's unfortunate it's come to this. I study Apple's Privacy Nutrition Labels religiously every time I consider installing an app. I like the ones with "Data Not Collected".

I'm an app developer and all my apps have the "Data Not Collected" privacy nutrition label. I love the idea, but Apple's enforcement of it is very lackadaisical. I've reported dozens of apps that were blatantly lying on their privacy nutrition labels to Apple and I'm yet to see any such app's nutrition label change.

Here's a good overview of the problem: https://arxiv.org/abs/2206.02658v3

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#84

Post by pyaamb »

pyaamb wrote: post #60

Need to rethink the system that allows for (and encourages) this kind of plausible deniability. From "Oh we need this permission for [non essential feature] and you need to accept it if you want the app at all" -> to giving the user ultimate control over what happens on their personal device. Virtualize what the app can see and use fake data/identifiers/devices if necessary to get it to do what its supposed to. If th…

Also perhaps AI agents are now capable enough to run these apps the way the user would and recognize these dark patterns. Flag those and feed it back to a warning at the point of sale that users can upvote there to signal their disapproval and a threshold score that risks removal of the app from the store. Because bad behaviour continues to make business sense if the rules allow it. Moreover, it penalizes and puts pressure on the good actors as a "missed business opportunity".

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#85

Post by ajross »

drdexebtjl wrote: post #72
ajross wrote: post #63

Earlier quoted context omitted.

What you want is basically how it works. On both phone platforms and PWAs, all permissions are visible to the user explicitly. All of them can be revoked at any time. Apps are disallowed from requesting an already-denied permission. Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party softwa…

>Obviously apps can tell if they haven't been granted a permission By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission. In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.

That does nothing but start an arms race. Fine, audio "works" but do you get noise? Can you read back the sounds you play? No, right? It doesn't work, QED. Now the platform needs to fake the noise.

Likewise for any other hardware access you want, and most of them are harder. How do you fake local storage without storing anything? How do you fake Bluetooth access without virtualizing an entire device? Do you fake the screen dimensions to look like something else? Input latency? Where does it stop?

No, "does this work" is among the easiest questions to answer in technology. We aren't going to win this war.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#86

Post by boobsbr »

dogman1050 wrote: post #29
unixhero wrote: post #21

Earlier quoted context omitted.

It's great for shopping. But in the US you have amazon prime. We don't.

I have Prime, but I can't imagine installing the Amazon app either. The website works just fine.

AFAIK, the app is just the website in a webview.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#87

Post by victorbjorklund »

drdexebtjl wrote: post #72
ajross wrote: post #63

Earlier quoted context omitted.

What you want is basically how it works. On both phone platforms and PWAs, all permissions are visible to the user explicitly. All of them can be revoked at any time. Apps are disallowed from requesting an already-denied permission. Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party softwa…

>Obviously apps can tell if they haven't been granted a permission By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission. In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.

Soundd like a nightmare to build legitimate apps if you for example are building an app that uses the camera but you can’t in anyway tell that using the camera fails (because user had denied the permission 6 months ago and has no memory of it) and instead of being able to give a helpful error you are just ending up with I am guessing fake images (maybe just a black screen).

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#88

Post by Grombobulous »

If this wasn't such a serious issue I'd be inclined to make a joke about being surprised that AliExpress was capable of such a thing, but I guess the complete shitshow of a website is intentional.

I wouldn't be surprised if what I'm feeling is all a psychological thing where consumers associate jank with low prices so that's why sites like AliExpress and Temu look like a complete technical mess when in reality they're doing pretty advanced stuff like this.

Re: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

#89

Post by subscribed »

mark_something wrote: post #67
lovestory wrote: post #34

Earlier quoted context omitted.

You probably buy things off amazon that are dropshipped from AliExpress all the time. Stop with the elitism

On AliExpress I see things like 64 TB (no, not GB!) USB flash drives for less than 10 euro, obviously a scam. I also see less spectacular products but still good looking deals, but without a brand name so you can't search the web for reviews. On Amazon I never see products like that. That's why I prefer Amazon (and Coolblue and bol.com in Belgium).

I see this kind of fakes on eBay or Amazon all the time. It's even harder to report it than on AliExpress and I never had an obvious report of fakes upheld (AND eBay warns they will forward your identity to the seller. Great thing if the organised crime is involved in this)

Case in point, fake 2TB Sandisk ExtremePro microSD:

- £17 on eBay: https://www.ebay.co.uk/itm/336728033240 - even the images prove it's a fake (also $570 on sandisk.com)

Agreed, there's more of that on AliExpress but Amazon is not free from that either.

Post reply on HN