AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint | Hacker News Reader

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

blog.laserphile.com

1,059 pointsemctech337 comments

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days.

Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content...

Now I wonder, does this also allow websites to continue running in the background on mobile browsers? Playing media is one of the very few things that can convince iOS Safari to keep a tab running indefinitely, in my experience.

I wonder if it is something firefox and chrome devs need to look at because if it is accessing the audio device surely it should be notified to the user.

As I mentioned, I suspect that this is an active choice, as just displaying the icon whenever a media context exists seems much easier than inspecting the audio stream for non-zero volume media.

I can only assume that there are legitimate reasons for this as well, e.g. websites preparing/maintaining audio context for lower latency when they intermittently play audio etc.

Someone else mentioned that cloudflare uses the webaudio for verification challenge, but only triggers it briefly.

Ugh... Seems like we need an audio API web permission, or maybe do something like browser already do for some of the other APIs and actually require API users to actually play something or display a warning/play an annoying chime otherwise.

Not just notified but blocked by default. We already have similar bocks on autoplaying video (no audio until you interact) and access to microphones and cameras ("allow access.." popups).

Every time an article like this comes out, people wonder about aliexpress instead of why their browser allows this in the first place.

I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue.

@FireFoxDudes You need to be addressing fingerprinting

How? How would a browser "know" what classifies as finger printing? Literally every piece of the engine is used for finger printing.

It can be mitigated, a bit, but I don't see how browsers can win that battle.

Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).

I feel like there are two levels of fingerprinting here, and a lot of the confusion is downstream of not properly distinguishing them:

There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc.

I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.

I've only encountered the latter described as fingerprinting. Which makes sense side, like fingerprints, the information is being used to uniquely identify an individual.

The former is traditional analytics and is not enough to uniquely identify an individual.

Not all analytics are as privacy invasive as fingerprinting.

>The former is traditional analytics and is not enough to uniquely identify an individual

shockingly little information is required to uniquely identify someone.

"traditional analytics" (lets just say os + browser + some hardware info) is likely to be uniquely identifying when combined with just one other sparse dataset.

>Not all analytics are as privacy invasive as fingerprinting.

fingerprinting isn't a separate category of analytics. every data point can be (and often is) used for fingerprinting.

Just assume any site using javascript is using it for nefarious purposes.

Fingerprinting cannot be resisted. There are a zillion techniques to get bits of information which can provide a unique-ish identifier when combined. The only protection is to mix in some random data in all these bits to get a very unique combination that changes on each request. But this only works if at the same time cookie and local storage access is disabled for all sites and whitelisted per site:target combination.

a lot of what is used for fingerprinting is also used legitimately, and a lot of sites fingerprint. so ~every site would be behind a security risk warning.

we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored

Presumably the intended outcome would be that sites would be pressured into not being malignant actors with regards to user privacy, rather than everyone just ignoring the security notice.

i understand the intention, and i offered my opinion on what the actual outcome would be.

~every piece of data can be used for fingerprinting. settings and preferences, browser, os, etc. fingerprinting is not its own category of data, it's the correlation of regular data.

the "pressure" ends up being: stop receiving any data at all (which would obviously break ~everything), or put up a warning (leading to fatigue).

consider accessibility settings: absolutely required for some people to browse the internet, but also extremely high-value data for fingerprinting a user.

there is no technical method to know whether a site asking about a visitor's accessibility settings is doing it so that they can properly display content or so that they can fingerprint the visitor. (i.e. there is no "evil bit")

I touched on this in my article, once the data has been collected and sent to their servers you have no idea what they do with the information. At least with GDPR it is supposed to be regulated but obviously that is not the case everywhere and websites can still lie.

> there is no "evil bit"

There's always been one, but it's been defaulting to 1 ever since the Web 2.0 upgrade, and the API to set it back to 0 has been deprecated.

Or just started removing features and debloating the Web standards. We don't need WebCoffeeBeansRoasterGrinder or WebElectricVehicleEmergencyBraking. We should be able to live with a LOT less without graphics, performance, or addictiveness degradation.

We already did, long ago, and this fingerprinting here does not work in Firefox.

A colleague of mine made a recent post here: https://ritter.vg/blog-webaudio_alibaba.html

It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period.

Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.

This issue is about audio output. Audio and video input are both behind per-site permissions.

Also, people can and should go to the firefox settings > Permissions and data > Autoplay and change the Default for all websites to "Block Audio" (at least).

You can set per-hostname exceptions if you like! CTRL + I > Permissions

Unfortunately that still gives another data point for fingerprinting.

> You can set per-hostname exceptions if you like! CTRL + I > Permissions

1. Thank you, that's very nice to know about.

2. I really wish this was exposed more directly, probably from the permissions button that is already in the address bar. I can't believe Chrome does this better.

You can access page info through address bar shield > connection secure > more site information too. It used to be easier to access from there, but they redesigned that at some point I think.

I do not have the Zoom app in any form installed. I'd much rather use it in the browser. When I close the tab, Zoom is gone. After the COVID era bullshit of Zoom installing a utility that gives root access to anything, I've never installed it. Luckily, all of that came out before I started using Zoom.

There's a solution to both:

1. Not make web browser general-purpose runtimes for arbitrary software.

2. OS builds a general-purposes runtime that's completely sandboxed. So users can run more complex software without needing to worry about cruft being installed on their system.

Unfortunately, browser builders have decided that web browsers are #2.

What is the practical difference if the OS provides your general-purpose sandboxed runtime instead of the browser? The browser is already a product being developed by the same organization as the OS for a significant chunk of people.

iOS -> Safari

Android -> Chrome

Windows -> Edge (based on Chromium, so fixes in Edge make their way into Chrome too)

The sandboxed application would be something you explicitly chose to run. When the browser is the platform, every web page you visit has access to the general-purpose runtime. (Of course permission checks e.g. for microphones exist.)

Why do you still need an explicit install step if everything is correctly sandboxed? If your only answer is you don't trust the sandbox then you shouldn't trust the one provided by the OS, either. Your browser's sandbox is tested way more than anything else.

They don't "just hand over access". If anything, browsers pioneered permissions for mic and camera on desktops, having them several years earlier before windows even got around to having these things restricted under permissions.

It does on my Firefox, I had to close their tab because it also tricks kde into thinking I'm playing audio.

Thaaaaaaat explains why an open Aliexpress tab always bumps my thermals ever so slightly.

What?

CPU gets a little hotter, fan runs a little faster. Close the tab, it calms back down.

The actual fingerprinting here does not work in Firefox though.

A colleague of mine made a recent post here: https://ritter.vg/blog-webaudio_alibaba.html

While it may not be effective at fingerprinting, the side effect of the attempt sure is annoying when it stops my music! Do you know if it would count as a bug if muting the firefox tab or the browser as a whole does not stop the audio stream?

The speaker icon would be handy but I think that it depends from both the good will of Firefox and the installed add ons. Of course if an add on blocks the audio file there is no need to display the speaker icon for that file.

To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my Android phone. It shows a number of sites. Nothing in first party and these that I must fully enable to make the site work (css, image, script, xhr)

* aliexpress.com

* ase.aliexpress.com

* it.aliexpress.com (my country two letters domain)

* umdc-global.aliexpress.com

* aidcgroup.net

* ase.aidcgroup.net

* 67372.ase.aidcgroup.net

* alibaba-inc.com

* epss.alibaba-inc.com

* alicdn.com

* ae01.alicdn.com

* assets.alicdn.com

* aliexpress-media.com

* ae-pic-a1.aliexpress-media.com

* assets.aliexpress-media.com

* aliyun.com

* acjs.aliyun.com

Scary list, right? According to google aidcroup is

> Alibaba International IPP Platform

> https://ipp.aidcgroup.net

> Alibaba International is committed to the protection of intellectual property rights. Right holders and their agents can enforce intellectual property ...

Let me add a /s to the last line

There are two more sites that I can completely block

* googlesyndication.com

* pagead2.googlesyndication.com

so even Alibaba runs ads on Google.

I did not instrument the browser like the author of the post did, so I don't know where the audio comes from. There is nothing listed in the media column of uMatrix. This does not mean that the post is inaccurate. It could be that the browser gets the audio stream from a request in one of the other categories.

uBlockOrigin blocks two of other requests.

1. https://g.alicdn.com/code/npm/@ali/gmod-pop-disclosure-code/...

and this one that I anonymize

2. https://aplus.aliexpress.com/g.gif?logtype=0&title=WebPush Permission&pre=https://it.aliexpress.com/?gatewayAdapt=glo2ita&scr=1920x1080&_p_url=https://it.aliexpress.com/wp.html&cna=<whatever cna is>&category=&aplus=&$${beacon_mini}$$=&yunid=&=&trid=<trid>&asid=<base64 stuff>$${get_sign}$$&p=1&o=linux&b=firefox153&s=1920x1080&w=gecko&ism=other&cache=<7 letters>&lver=8.15.25&jsver=aplus_std&pver=0.7.12&_pw=0&_ph=0&tag=1&stag=-1&lstag=-1&_slog=0

Probably the audio file is coming from one of the unblocked requests but my Debian laptop does not pair with my Bluetooth earpieces so I can't test it.

It doesn't actually stream an audio file, the scripts generate audio at runtime using a sawtooth oscillator. It also only happens after several seconds.

Thanks. So one of the downloaded scripts is generating the audio and the browser should detect it.

So what's the current usable fork of uMatrix nowadays?

Switched from NoScript in the days of 'HttpSwitchboard', then over to uMatrix, but using uBo only now.

Still missing some elements of uMatrix, though.

How does it work with uBo now? Where does it interfere? What are the redundancies to check for, and letting only uMatrix(whichever fork) handle it? What to disable in uBo for it to work effectively?

I'm using uMatrix. Works fine for me.

Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.

ebay does this i think, someone else linked a post about port scanning

Yeah, that’s always an automatic nope. No explanation of who/what is really asking or why so, no: your shit software or website can’t go snooping around on whatever network I happen to be on, whether that’s at home or at work.

pretty sure it is a way of fingerprinting your machine/network

Let's hope it's as simple as that and not a malvertising campaign.

Chrome says "this site", no? Isn't it the tab you have in focus?

I wonder what kind of person says 'Yes' to this prompt. It gives me the heebie jeebies.

3D mice and other hardware may run a local server for web applications to use them as input methods. The dialog can also show up if you are using network security software which proxies requests via private IP address range. Plenty of other non-nefarious reasons too...

Safari and Firefox allow this by default without a prompt or visible indicator (but maybe that has changed now that Chrome added its dialog).

No, it’s a macOS level prompt.

Then it’s most likely Chrome using local network access for WebRTC or Chrome without granting that access to websites without any explicit interaction with camera permissions or cast features.

Any chance it was a macOS prompt? Chrome needs local network permissions for WebRTC, Cast etc. even without any website accessing your local network.

It is most likely this: https://wicg.github.io/local-network-access/

For a while there's been an anti-pattern where a piece of software leaves a localhost daemon running (often without proper security) for web integration.

One of the more famous abusers was Zoom: https://infosecwriteups.com/zoom-zero-day-4-million-webcams-...

XSRF vulns also have existed where e.g. a web page can blinding attempt to hit your router's page to change your DNS servers by knowing common router admin sites and default home network topologies. This isn't as useful in today's HTTPS world.

Browsers have been adding more partitioning between local and internet resources to prevent this sort of thing. But that does mean simply putting localhost entries in a hosts file to blackhole a site can now cause an issue.

Something in my work's SSO / auth mechanism does this and if you click No it silently screws up the internal website you're visiting. It doesn't block you from logging in, just parts of the site don't load/work. I haven't been able to get a good answer on what the heck is going on but it's extremely annoying.

I had this and it turned out to be my unifi firewall block triggering a false-positive in the browser.

Are you running PiHole, Adguard or similar and using macOS? On macOS, Chrome treats 0.0.0.0 as a local address which results in these prompts. Switching to having blocked domains return NXDOMAIN can work around the issue.

Thanks! Could be AdGuard!

usually its scanning for chromecasts on the local network, but could be other things as well

I would note that if you say no to this, not only automatic but also explicit top-level navigation to “local network” locations (e.g. localhost, 192.168.1.x, etc) will be denied. Kind of annoying when you don’t want Chrome exploring your network, yet still need to regularly e.g. access your NAS web dashboard.

It should instead trigger a little germ icon, like a virus, because it's like a virus.

> I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content

When most sites do browser fingerprinting using audio, they use an 'OfflineAudioContext' - which unlike a normal AudioContext, doesn't run in real time and send its output to system's loudspeakers; instead, it runs faster-than-real-time and outputs to an AudioBuffer. So the browser can easily tell no sound is being played.

For example - you can tell the browser to create a 10kHz square wave, feed it to a GainNode then a DynamicsCompressorNode, output to a buffer, then hash the contents of that buffer - which gives you a browser fingerprint, because of subtle differences between browsers.

With my previous hearing aid I noticed that visiting a wide variety of web sites would cause a change in the amplification of environmental noise. I always assumed it was doing something with Bluetooth, and probably not for a good reason. This is with an iPhone 13 and one Kirkland/phonak hearing aid.

I haven’t noticed this recently, but I also now have two newer Phonak hearing aids and a few iOS updates have happened. Maybe the silent Bluetooth shenanigans are less disruptive to my new aids or the programming is different. Surely shenanigans continue.

I wear Phonak CI processors. It's not just you. I've also experienced the volume drop on a few sites and apps. The Amazon iOS app does this. Each time I leave the app, ambient audio returns to normal.

They’re kindly turning down the background noise so you can focus on shopping and buying more stuff.

It'd be interesting to see what a lawyer specializing in disability law would think of that.

At least in the US, I could see that being something that the ADA prohibits.

It seems far more likely that your cheap hearing aids are sensitive to certain RF frequencies and the background javascript is causing different patterns of load on the phone's CPU.

I would suspect that this only happens when you're charging and it is likely the charger or cable not being properly shielded.

The cheap hearing aid cost $750 for one and is substantially the same as the same thing sold from standalone audiologists for much more. These are not cheap over the counter devices.

Charging only happens while in the cradle, not while worn.

> cheap hearing aids

I don't think you know what you are talking about

Audio is being generated and the BT device is prioritizing it by changing its internal mixer settings. Same as audio prompts over music in a car. This could be mitigated by detecting silence in the audio stream but this is anti-consumer behavior that needlessly drains batteries with excess transceiver activity.

It's the Bluetooth; when Bluetooth connects most hearing aids reduce the environmental volume slightly so you can hear the streaming content. Some app has started to play audio (perhaps silently). I notice it on some websites.

How much HAs reduce environmental sounds when streaming is configurable by the way, but only by the audiologist if you don't have your own programmer. I don't like the effect and prefer to just turn down the volume manually.

Is this tunable per hearing program? When in an even moderately noisy environment I find myself switching to AirPods if I’m streaming. I would love for the HA to give separate controls for BT audio vs ambient like AirPods do.

I noticed my MBP had a periodic stutter sometimes: every 3 seconds or so the mouse would lock up for a few milliseconds.

I tracked it down to American Express's login page (auto loads if you leave the site idle) relying on Akamai's anti bot measures polling some web Bluetooth feature, causing Chrome to trigger a BT scan: https://castle.io/research/fingerprint-harvesting-in-the-bot...

Turning off Bluetooth solves it, but that's not a great solution when using a Bluetooth mouse... and it sounds like it might be causing your issue too.

I have the same on Android with my phonaks - not websites though, but both taking a photo and paying using Samsung pay appear to open an audio stream briefly, just long enough to jump into Bluetooth mode. It takes ~6 seconds to go back afterwards.

Quite frustrating as I'm often needing to hear the cashier at that point!

I noticed in the last few weeks that if I’d recently opened the AliExpress iOS app (ie. it was backgrounded) my car audio would freak out thinking I was giving it an audio command. Killing the AliExpress app immediately fixed the problem. After seeing it happen more than once I assumed it was something dodgey and uninstalled the app.

I cannot ever imagine installing something like AliExpress as an app.

It's great for shopping. But in the US you have amazon prime. We don't.

Where is "we"?

Likely the place where people are "willing to trade privacy for convenience", according to Baidu's CEO.

I always wonder if it's worth it. Like: is it actually convenient, or is it 'solving' inconveniences which actually do not exist or didn't exist before using the service? I have never used Prime or AliExpress but also don't consider our typical shopping very inconvenient. And the most inconvenient parts are actually the ones which seem necessary to to get the proper goods (from past weeks: vegetables/fruits/shoes - it's not really possible to order that online and get exactly what we want). And everything else is available from other webshops.

According to their profile: Norway

I have Prime, but I can't imagine installing the Amazon app either. The website works just fine.

This is the way. It's prudent to treat apps with skepticism, it's unfortunate it's come to this.

I study Apple's Privacy Nutrition Labels religiously every time I consider installing an app.

I like the ones with "Data Not Collected".

I'm an app developer and all my apps have the "Data Not Collected" privacy nutrition label. I love the idea, but Apple's enforcement of it is very lackadaisical. I've reported dozens of apps that were blatantly lying on their privacy nutrition labels to Apple and I'm yet to see any such app's nutrition label change.

Here's a good overview of the problem: https://arxiv.org/abs/2206.02658v3

Why have rules (or laws) if they don’t enforce them? Or only enforce them selectively when they feel it necessary, such as when not doing so would threaten your stock price (or re-election campaign)? Maybe I just answered my own question?

Reminds me of meat processing regulations. I can sell my animals whole to buyers through a custom processing exemption, but they must go pick up their meat from the butcher. The law says I cannot pick up and deliver it, but it is trivial to find people advertising that extra service. Reporting them does not result in any obvious action.

In both of our cases, our honesty is a liability in the marketplace, because people are ignorant of such laws (or simply don’t care). Really, they simply want the product that they want, as conveniently as possible. We are then forced to compete in the marketplace with liars and cheats.

I am sure our peers here can find countless examples in other areas where this flavor of dishonesty prevails. Hell, I would love to hear some counter examples, because I cannot help but view this state of affairs as intentional at this point.

The purpose of system is what it does (or, in this case, does not do).

The cynical way to look at this is that the purpose of the system (the privacy nutrition label) is to support Apple's carefully-crafted and -marketed image as the most privacy-focused of the tech giants. Actually having enforcement of the contents of said labels would be a nice potential byproduct of that, but that's not strictly required to accomplish the system's purpose.

Oh man… that's a rude awakening.

I can't help but feel the whole Apple privacy PR will be blown in the future where some report will come out that Apple has been logging and sharing user data with NSA since 2001.

With Firefox, yes. I wouldn't fully trust other browsers to care about my privacy.

Using web apps on Firefox really is the way given its support for uBlock Origin.

Screen real estate is precious on phones, so being able to permanently block "Install our app!" and even entire navigation categories (shorts on LinkedIn) is quite valuable.

Then you can "install" the site on your home screen or simply place it in collection folders so it's sitting ready on your "New Tab" page.

Firefox the privacy browser that is directly selling all its users searches to Google for decades? Not to mention all its other build in telemetry and ads.

If you want an actual private Firefox Browser use a fork like Mullvad Browser, LibreWolf and Tor Browser.

Mozilla with Firefox does not sell and does not have ads. You have downloaded a modified spyware version or have convonced yourself that this is true due to a bad dream. Take more care online is my advice yo you and don't spread false information either.

>Mozilla with Firefox does not sell and does not have ads.

https://support.mozilla.org/en-US/kb/sponsor-privacy

https://blog.mozilla.org/en/mozilla/mozilla-and-google-sign-...

The only one trying to convince themselves is you...

I think you need the app to use the delivery lockers (which I prefer over home delivery)

AFAIK, the app is just the website in a webview.

I uninstalled the app recently; despite having layers of ad tracking protection, I would see my Amazon searches appearing in my social media feed in near real time, and this irked me.

I dropped their .com into a Home Screen icon, and this completely stopped (at least as far as I’ve observed). It’s definitely more janky from an experience perspective, but still easier than driving to the store.

Shopping works better on web sites because can open multiple tabs to browse multiple products. Especially important on big stores like Aliexpress and Amazon where need to compare lots of products. Desktop is better for that but mobile browsers are still better than apps.

I don't have Amazon Prime (nor am I in the US) yet use Aliexpress perfectly fine on my mobile phone without using an app. Frankly, I don't understand how the two is related at all?

AliExpress won't allow me to open most pages in the account section on my iPhone. Instead I get a page telling me to install the app.

While browsing, there are also popups offering the app approximately every third link I click. Some of them are telling me to install the app.

Unless the situation has changed recently, it's not perfectly fine, it is unusable on purpose.

AE website on mobile is terrible, they basically force you to use the app. I exclusively use the website on my PC

So they're pulling a Reddit, basically.

"The app is great because the website is heavily degraded".

I just request the desktop site, it's fine

Reddit is fine, just a small popup at the bottom. Facebook kn the other hand turned off most functions on mobile, e.g. chat. Good thing though if you don't use the chat long enough, friends start using other means of communication.

Reddit is NOT FINE. They throw up full page modals now telling you to continue in the app.

Soon we'll realize that the experience of using reddit (and other mainstream social media) differs a lot based on what country you're in, and sometimes even the state.

For example, seemingly a bunch of places in Europe/elsewhere has disabled old.reddit.com unless you're logged in, but seemingly a bunch of people in other places can use it just fine. I'm sure what both of you are seeing is both correct, there is just something changing the experience that gets served to each of you.

    Log in to use old Reddit
    
    To keep Reddit safe, accounts are required to access old Reddit. Log in, or continue without an account on reddit.com.

First time I've ever seen it. No clear way to bypass it either.

I think it’s a push for either more tracking through login or to push people to more addictive features like endless scrolling and autoplaying videos.

https://www.reddit.com/r/modnews/comments/1ujtebf/logging_in...

It went into effect 2 months ago, there is no bypass for it by design.

Haha, yeah. Reddit for the longest time hasn't allowed me to browse certain subreddits without the app. I basically ignore search results from it.

As the sibling poster mentioned, might depend on location, but it DOES happen.

Both are web stores. Both have websites AND apps.

They are compared / contrasted. Nobody is saying one is concretely related to the other.

You probably buy things off amazon that are dropshipped from AliExpress all the time. Stop with the elitism

This is not about the products that are shipped, but the app itself. I would caution people to never install it as well.

Do you trust the X app? Whatsapp? gmaps? Where do you draw the line?

Is it one of these HN usual "ChInA BaD" psychosis ?

In order: no, no, no, and no. I accepted that I can't avoid google spying on me on android, if I could have a phone that works with banking apps without google's crap I would, but thanks to their safetynet racket it's not possible for me.

I buy directly from AliExpress all the time. I wouldn't install their app.

Love Temu and AliExpress for specialized components at dirt cheap prices. I would never, ever install their app. Ever, security nightmare.

Similar to how I use Amazon Prime but would never order something I ingest, put on my skin, or (usually) wear from it.

Not elitest.

I would never use Temu for anything.

Elitism has nothing to do with refusing to buy products made with slavery.

A lot of people are critical of historic slavery whilst happily buying from Temu. That’s scummy as hell.

https://www.bbc.co.uk/news/business-67752413

On AliExpress I see things like 64 TB (no, not GB!) USB flash drives for less than 10 euro, obviously a scam. I also see less spectacular products but still good looking deals, but without a brand name so you can't search the web for reviews.

On Amazon I never see products like that. That's why I prefer Amazon (and Coolblue and bol.com in Belgium).

Few years back, Amazon had a rampant "fake USB storage" problem too. Then, one day, all the fakes were gone, just like that.

If you believe that, I have some USB storage to sell you. Huge capacity, barely used. I keep my inventory in storage under this bridge, which I also happen to have for sale. Interested? ;)

I see this kind of fakes on eBay or Amazon all the time. It's even harder to report it than on AliExpress and I never had an obvious report of fakes upheld (AND eBay warns they will forward your identity to the seller. Great thing if the organised crime is involved in this)

Case in point, fake 2TB Sandisk ExtremePro microSD:

- £17 on eBay: https://www.ebay.co.uk/itm/336728033240 - even the images prove it's a fake (also $570 on sandisk.com)

Agreed, there's more of that on AliExpress but Amazon is not free from that either.

Having bought many things off AliExpress over the years I can say with complete confidence that I've never made a purchase on Amazon that was dropshipped from Ali. The shipping times are far different and it would be immediately obvious.

I've ordered things from AliExpress shipped from the local warehouses (2-3 days delivery) ; I've ordered things on Amazon UK that were fulfilled and shipped from Amazon UK that were delivered in 3-5 working days.

Not a £1 tat, and not one off. Not that AliExpress is my choice, no, far from it. Sometimes it's better, closer to the manufacturer, that's all.

Yeah it would be hard to hide. When I order from AliExpress it arrives via Chinese carriers I have never even hard of, and about half the time the final delivery is through a Chinese gig delivery company that must pay practically nothing to the driver because they will usually drive up in front of my house and chuck the package out the window onto my front lawn.

I cannot imagine installing amazon as an App as well. It's a website

I can't imagine ever wanting to install an amazon app either. Both of these stores have perfectly functional websites. What would I gain installing their spyware? Also, why so defensive?

In first world countries, buying from a local reseller grants you customer rights (like returning or replacing defective items).

Not if the local reseller simply calls itself a marketplace and logistics company and the local regulator lets them get away with it.

Amazon, in my experience, does arbitrate disputes about returns and defects, but the important point is that from a legal perspective, I don't think they have to, so you're at their mercy.

You can't even be sure that VAT is handled correctly, which local retailers can usually not get around.

Not sure if they still do, but a couple years ago prices in the app were lower than on the website. And they promoted installing it to save money.

> Not sure if they still do, but a couple years ago prices in app were lower than on the website. And they promoted installing it to save money.

Translation: They are able to mine your personal data more completely with an app installed vs the website which they can sell for pure profit. They promoted installing it to extract more value from you.

That's definitely a feasible explanation (and the one I would assume to be true for AliExpress).

But there is another, slightly less evil, explanation that I know at least some companies have pushed their apps because of: the thinking is that if you're on their website, there is less friction to open a new tab and search for a lower price from their competitors, than if you're in their app. Obviously it's hardly any different - opening a new app (the web browser) vs. opening a new tab in the app you're already in - but the theory is that there's a slight psychological difference.

Of course I'm not saying that trying to prevent your customers from searching for better deals is a nice thing to do. Just adding that data mining isn't the only reason for some companies to want people to use their apps.

It's quickly getting to the point for me that "find the thing I want locally and buy online if it's cheaper" is reversing. I've actually been to one of the few remaining electronics retailers to look for a PC for my kid recently, and it was nice not to be assailed by dark patterns (yes, there are dark patterns in b&m retail, but they're much more obvious).

It also all goes to the party, who are the owners of Alibaba (and every other company in China).

Should you ever need someone in a foreign country to do something for you, it's good to have as much information as possible at your disposal about them.

I believe the prices are the same. But the app has a number of "games" to collect tokens that get credited as discounts. Seems to be mostly stuff designed to get you to open the app daily and browse their offers. Which might be "innocent" if it's just to get you to buy more stuff, or maybe they have more reasons they want you to have the app open. Who knows

At least Aliexpress doesn't have all the fake slot machine type games that temu has that always end in variations of "get $200 of discounts for your next order if you order x items from this list"

There are few things more scammy than AliExpress “discounts”. I have yet to see a cent of the hundreds of dollars of “savings” they gave or advertised to me.

Very true, I almost never use Ali Express because I have no clue what anything is going to cost until I get to roughly the final step of checking out.

They used to give 5-10 bucks of credit to new users a few years ago. Real credits, I very carefully compared prices from different IPs.

So I would register a new account for each order -- 10 USD is quite a lot of money in my country -- and saved at least a hundred on buying dev boards and other components.

Now we know why...

And someone would install random apps to save $5 on $100 purchases?

You'd be surprised on what general public can go to save $5.

I mean, I'm haunted by the things I did for a Klondike Bar.

When I did customer tech support for a major retailer, we had confused customers calling all the time because they would randomly get price-match refunds they never asked for. They were installing apps that were automatically requesting the refunds by searching their emails for orders and checking the prices on the websites. These people had no idea they had even given these apps permission to read their emails.

"random apps" and it's the largest eCommerce company on the planet

So what? I install 0 ecommerce mobile apps.

What, I suddenly need to buy Alibaba crap and I can't wait to get to a laptop browser?

You've moved the goal posts there.

"Why would anyone install a random app"

"Why would anyone use a phone to make a purchase"

Globally, more than half of all eCommerce purchases are made on a phone or tablet.

>Globally, more than half of all eCommerce purchases are made on a phone or tablet.

For no good reason in places where the phone is not the exclusive access many have to the internet (like it's for many people in the poorer places in Africa for example).

(And the number likely includes things like food delivery and digital goods like game assets and apps themselves)

> Globally, more than half of all eCommerce purchases are made on a phone or tablet.

The fact that all uneducated crash test dummies are purchasing via dubious apps doesn't mean a seemingly educated population about computer hygiene as I would expect is visiting hn would do that as well.

And it is not about purchasing from mobile, but app vs web browser.

eBay keeps pushing their app with a $5 discount, advertised using a focus-stealing popup interrupting your attempt to give them money, so some people must be taking the bait.

Sure. I can live for a day on those five bucks. You wouldn't believe what people in low income countries go through to save a bit of money: I've seen people I know (but couldn't stop in time) send copies of their ID to some shady company to get a five percent discount on gasoline.

It's still the case that you pay less in the app. You get 'coins' for a daily check-in, which are automatically(?) applied as a discount. Most items either don't actually use them or only give you a pointless 1% off or something, but I've gotten a $12 microcontroller for $5, for example. I think some coupons are app-only, too (though most aliexpress sales are fake and are better thought of as the normal price).

>You get 'coins' for a daily check-in, which are automatically(?) applied as a discount.

This should be illegal

You pay less money in the app.

Companies are not going to hire a mobile dev team to create an app to give you a way to pay them less for a good.

They hire a mobile dev team to create an app to give you a way to hand over data that you otherwise wouldn't, is technically impossible to do through a web browser, and is worth more than the discount that they give you for using the app.

They also don't give you a proper tracking number. The only way to track your shipment is in the app.

This is not correct. I do not have the app and get tracking for my orders.

I get email updates but whenever I click the track link it tells me I need the app.

If on mobile, ticking "desktop mode" in your browser usually goes around that dark pattern.

It does show a popup to that effect, but if you dismiss it you can still see the tracking info. Definitely annoying, but not unworkable.

I have a package on the way with AliExpress. It is headed from somewhere in China to somewhere in the US.

Using my computer just now, I looked at one of the emails that AliExpress sent about this order. It had a clickable tracking number displayed; I clicked it.

That brought me to their website, where I landed on a page that included the last update for my order and also a link to "View Details".

That works for me. It was very easy to where along the line my stuff is (and that it is not in the US yet).

---

Meanwhile: I also copied the tracking number from the email. I pasted that tracking number into the box at usps.com.

The USPS knows of my tracking number and they do not have my item yet. Fair enough.

I ticked some boxes and told them to send me updates, which I'm sure they'll do once they have updates to send -- just as they have done for ~decades now.

This also works for me.

Many sites will work fine in a desktop browser but refuse to do anything in a mobile browser, demanding you install their app or just immediately redirecting you to the iOS or Android app store.

Depends on the shipping company, and likely on your location. I get tracking numbers for most but not all shipments

You just have to press the right link on the site and you get the tracking page (despite saying you need the app).

That's how you know you absolutely should not do that.

Like a white van with FREE CANDY written on it...

It worked for Reddit... It used to be a 100% website experience and now I'd venture the majority of their traffic is from the mobile app.

Selling your soul for a discount. I almost never download native apps. If they go to the lengths shown in this article to side-channel fingerprinting, imagine what they do when they have native privs.

Absolutely crazy the amount of dodgy apps people install and giving permissions to read the system when asked...

Yesterday on here, somebody was demo'ing a sun clock website that asks for your position.......

....and yes, many HN'ers were clearly happy to give there precise GNSS coordinates to some random scrote who askes for them.

What's the threat scenario here? Unless you Saddam Hussein...

a) They don't need by exact location, so why ask for it?

b) Browser fingerprinting and the like links this position to me and my activities.

Do you not find it bizarre that many people see nothing wrong in routinely giving their precise location to anybody who asks for it?

A lot of people install TikTok. Or Instagram.

Or Claude/etc on their personal computers and then even live dangerously.

But isn’t the promise of the app store that the apps are checked for malicious code and more control of the permissions compared to a browser website?

That's the promise, yeah.

They're all doing some level of this

That's why I don't install any app, unless I really have to. Just use the website.

It's known that some Chinese mobile apps employ this trick to keep the app alive in the background, the rumor is that this way the 'active user' KPI can be better met.

edit: quantity qualifier

If it's known, are you suggesting that Apple and Google are complacent in allowing these type of apps in their ecosystem?

I wouldn't think of giant organizations like Apple and Google as mere individuals that can exercise human emotions such as complacency.

Why would they manipulate the numbers that way if it’s self-reported anyways? If you want to fake the numbers, couldn’t you just change the number and be done?

It's probably quite difficult to manipulate per-user metrics after the data is collected.

The people fudging the metric (developers) may not be the same people that are relying on the metrics (managers). Perverse incentives at play could easily motivate this kind of shenanigan.

And that's OK with Apple's App review?

I'm wondering if the reviewers neglected to review the app while driving a car and listening to audio.

They let all sorts of stuff that they shouldn't in.

For instance, Meta and Google publish 'free' iOS libraries that firehose surveillance data back to them. The libraries are popular, so apps that use them must be allowed into the store despite taking them as dependencies.

If you can get access to .ipa files (I think you'd need to jailbreak -- apparently this stuff is encrypted by Apple) or packet sniffer, then you can get an idea of how bad it is for the apps you use.

This tool claims to do the sort of analysis I'm talking about (among other things), but I've never tried:

https://securitywall.co/tools/ipa-analyzer

So Apple will remove them from the App Store. Thats their whole argument for their closed system - they’ll protect users from malicious apps. Right?

it's not the app that it's malicious, it's the website

It's both, according to another comment.

And maybe all the big airlines will learn geography 101.

Report it

i'd argue that perhaps the ability to play audio should be permission gated, much like the ability to use webcam/microphone.

However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to.

With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing this, I'll be more willing to be bothered every time I want to play a video with audio to approve it if this bothers me.

The ability to play audio can usually be permission gated with tab muting, however the methods aliexpress use bypass that mechanism completely.

This is the part you should be highlighting aggressively. That’s very uncomfortable

I would actually love if I could have iOS prompt me to allow certain apps to use the speakers. I hate using an app and suddenly have a video autoplay loudly.

This. This needs to be a thing.

To be fair, it shouldn't need to be a thing.

(One should really not tolerate such dodgy software).

I wish Android had this as well. There are apps where it's difficult-to-impossible to turn all sound off, and I wish I could just tell my phone that this app is just never allowed to use the speakers.

On Samsung Android phones there is a Samsung app that isn't installed by default that allows to individually manage volume/mute per app called SoundAssistant (and few more neat customizations for audio/audio controls).

I don't think many people know about it, it's made by Good Lock Labs which is basically a group of Samsung devs making advanced customization apps: https://galaxystore.samsung.com/detail/com.samsung.android.s...

You access the features from the OS volume control once installed, there's a "..." button.

Always wondered if that also works on non-Samsung phones, but it's quite useful to forever mute an app.

Inside iOS accessibility settings you can turn off “auto-play video previews.” This blocks perhaps 20% of video autoplay; it’s still better than nothing.

Philosophically I hate silent video autoplays just as much as I hate autoplays with audio. One distracts your visual attention, the other distracts your aural attention, and I don’t quite understand why society has normalized silent video autoplay.

Firefox allows to Block "Audio and Video" (or "Only Audio") from auto playing per domain, including on Mobile.

WebAudio fingerprinting is largely mitigated (in Firefox, potentially other browsers) - I wrote a quick overview that talks about the current distribution of values as well as our more recent efforts. https://ritter.vg/blog-webaudio_alibaba.html

Thanks for your input and perspective! Do you think it is a bug that the muting of the firefox tab doesn't stop the audio stream? It is frustrating that companies would use such an annoying tactic to track their users with it also ineffective.

Yes, it is a bug, in fact it's this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1863193#c9 which is of course getting some more attention now =)

Good to know! I have added a note and link to my post.

Ah, so that's what Wolt (Doordash but in Europe) is doing.

I noticed that Voice Over (iOS screen reader) crackles and randomly changes volume when using the app, but I attributed it to standard iOS weirdness, and possibly misuse of some iOS API. Now I'm thinking that this may very well be fingerprinting.

Recently I ran into a problem with my Bluetooth headphones. They support multipoint bluetooth audio, so they can be connected to my PC and phone at the same time. Opening the Aliexpress webpage causes a silent audio stream keeping the PC>headphone link active blocking my phone audio. An investigation reveals obfuscated code running device fingerprinting with a side effect being a silent audio stream that firefox, chrome and windows does not recognise but which kept the bluetooth connection active.

Is this an AI summary of the article?

No, I took the first sentence of my article and then edited the rest of the intro + conclusion to keep it short for HN.

You should make that obvious in some way like using “TLDR”. I assume many people, like me, would attempt to parse your comment as a comment on the article, after all it’s in the comment section, and read that way it’s very confusing lol.

Sorry, this is my first post to HN and in the submission it looked like the description text i added would be part of the post header.

I was just about to highlight this particular HN quirk. I suppose a lot of people here only ever comment (or submit URLs without any text of their own) and aren't familiar with it.

Don’t apologize. This was a very fascinating read, and a good technical write up, especially for you first even HN post. It’s not your fault others didn’t look at the username :)

Thanks for the feedback :D

HN's fault entirely. The post form's actioning "text" as a comment is remiss.

Ah, sorry I wasn’t aware of that either

Sorry, I didn’t realise you were the author

They shouldn’t have to make it “obvious”. They are the actual author of the article. It’s not their fault you didn’t double check the usernames. It’s not uncommon for authors to comment on their own articles.

No you are talking to the actual author of the article. It’s not weird for the author to comment on their own article

Concerning situation, I think. And I suspect (perhaps wrongly) that there are even more reasons for concern with technology that can track, capture, leak etc. information that's more sensitive or valuable, depending on how one wishes to look at it. Mobile phones, computers, routers etc. -- all have the potential to siphon out valuable information to a bad actor, especially when it comes to espionage, military, commercial etc. This has already happened at a significant scael, so it's not a remote scenario.

At the very least, governments and institutions should develop a framework to investigate all acquired technology. The community / civil society could also create something similar, a script that would analyse at a deep level everything that can be analysed with a piece of software even by a complete novice.

Yes, I find it concerning too. I particularly dislike that windows was not aware, nor could it stop the audio stream from effecting the hardware. What other side channels like that exist? Perhaps I can be blamed for using windows

> Perhaps I can be blamed for using windows

That would be unreasonable, I argue. No one should have to worry about the security of their devices and data privacy based on which OS they use. Whilst it can be argued that different OSs serve different needs, privacy and security should not be debatable. In fact, most countries have dedicated legislation for this; whether it's just, applied correctly, or serves the public before any other party are indeed discussions to be had.

We take everything we have, freedom, privacy, free speech, for granted. The reality seems to be that these concepts are fungible and that we have to be ready to fight for them. Instead we trade these for convenience, and it's very very sad.

I am pretty sure my phone is listening. The ads I see this week are about topics I discussed last week. Week for week. Stupid thing is that I need the phone to have near by as self-employed electrician. Clients want to communicate after regular office hours. Since the phone is rigged why computer shouldn’t?

A part of me is always smiling a little inside when people find creative ways to abuse browsers. It's always one more demonstration that the current web is fundamentally broken by design. The distinction between web browsers and random programs that allow remore arbitrary code execution is becoming more and more academic with every new feature that gets exposed to JavaScript.

Of course, I am also a horrible hypocrite and will actually use websites that use features like WebUSB or WebRTC.

It was a mistake to normalize blindly executing whatever code the server sends your browser. One day we'll look back on this era and wish we had pulled the plug sooner.

Need to rethink the system that allows for (and encourages) this kind of plausible deniability. From "Oh we need this permission for [non essential feature] and you need to accept it if you want the app at all" -> to giving the user ultimate control over what happens on their personal device. Virtualize what the app can see and use fake data/identifiers/devices if necessary to get it to do what its supposed to. If the App isn't going to act in good faith why should the user? Fine grained permissions don't really work in practice because the app can keep annoying the user until they give in and hit Allow.

What you want is basically how it works. On both phone platforms and PWAs, all permissions are visible to the user explicitly. All of them can be revoked at any time. Apps are disallowed from requesting an already-denied permission.

Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party software isn't under any obligation to work without them.

But the platforms have done what the platforms can do, at the architecture side, really. The next stage is human-audited enforcement of malware, which this AliExpress nonsense might hopefully run afoul of.

> Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working),

How can they tell? For the permissions I can think of: location, filesystem, etc. it should be easy to lie/spoof.

>Obviously apps can tell if they haven't been granted a permission

By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission.

In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.

That does nothing but start an arms race. Fine, audio "works" but do you get noise? Can you read back the sounds you play? No, right? It doesn't work, QED. Now the platform needs to fake the noise.

Likewise for any other hardware access you want, and most of them are harder. How do you fake local storage without storing anything? How do you fake Bluetooth access without virtualizing an entire device? Do you fake the screen dimensions to look like something else? Input latency? Where does it stop?

No, "does this work" is among the easiest questions to answer in technology. We aren't going to win this war.

The best you can do on the modern web is reduce your fingerprint footprint, though it comes at a cost of websites breaking from JS disabling, or local time zone anonymisation.

> Can you read back the sounds you play?

No, but you also can’t do that if the user approves your app’s permission to play audio, but has the volume permanently turned down to zero.

> local storage

Give the app a temporary, space-constrained store that isn’t shared with other apps.

> bluetooth

Don’t let apps access raw bluetooth signals, but instead ask the platform to display a pairing interface (possibly with a custom stylesheet), ask the platform to call you back when a specific device is in range, etc.

> screen dimensions

Not personal data.

> input latency

Fudge the numbers even when the user grants permission.

This isn’t a war, it’s just engineering for the benefit and autonomy of the user, and not the platforms’ commercial interests.

> This isn’t a war

Fingerprinting and other quasi-malware techniques being used by desirable third party software are absolutely a war, otherwise we wouldn't have this permission structure in place in the first place. And as much as you believe the contrary, Alibaba et. al. are 100% smarter than you about how to exploit these tricks and will win.

> Not personal data.

LOL

I don’t appreciate the personal attack. You don’t know me.

Permissions have nothing to do with preventing fingerprinting, they have to do with user control. Every permission you add that the app can inspect is one extra bit of fingerprint, so it’s actually worse.

In TFA’s case, if the app was simply not hooked up to an actual audio sink, they would still be able to use this mechanism for fingerprinting, since it’s the processing pipeline itself that leaves the fingerprint.

Note that the article isn’t calling out for fingerprinting specifically. I’m sure AliExpress does more fingerprinting than this. The problem is specifically that they’re interfering with multipoint Bluetooth audio.

Soundd like a nightmare to build legitimate apps if you for example are building an app that uses the camera but you can’t in anyway tell that using the camera fails (because user had denied the permission 6 months ago and has no memory of it) and instead of being able to give a helpful error you are just ending up with I am guessing fake images (maybe just a black screen).

The image could contain a message that it is disabled.

Then it is detectable. Those permissions should have a third option alongside allow and block - spoof.

So we must also make it impossible for an app to read any images taken inside the app itself? You can’t literally make any apps at all

Just because it's hard doesn't mean you shouldn't try. What about a popup saying "xyz has tried to access the camera a lot lately, continue blocking?"? Or apps can apply for set of 'core permissions' that can't be denied but are much more tightly controlled? Apple and Google are some of the biggest companies in the world, they don't deserve as much leeway as you're offering.

Also perhaps AI agents are now capable enough to run these apps the way the user would and recognize these dark patterns. Flag those and feed it back to a warning at the point of sale that users can upvote there to signal their disapproval and a threshold score that risks removal of the app from the store. Because bad behaviour continues to make business sense if the rules allow it. Moreover, it penalizes and puts pressure on the good actors as a "missed business opportunity".

Maybe just have Claude rebuild the app in a non-scummy way. Analyze the site for the relevant data APIs, while avoiding the tracking stuff. Maybe someone maintains an MCP for these popular websites so people can use agents on them.

Browser fingerprinting can get creative at times, to say the least. eBay's WebSocket port scanner [1] and Reddit's abuse of DRM and JavaScript JIT exploits [2] from years ago are two examples of the kind of in-depth introspection you can perform completely in the background using nothing more than simple non-permission-gated APIs.

[1] https://blog.nem.ec/2020/05/24/ebay-port-scanning/

[2] https://iter.ca/post/reddit-whiteops/

Thanks for the reads

I've seen this on many many other sites as well, most notably Twitter, and lots of common modern captcha pages too. Very annoying!

JS enabled by default seems every day less secure.

So many website break completely with JS disabled and you end up having to enable it half the time anyway.

It was pretty good until about six months ago. Since then loads of sites have added a js requirement to try to stop the AI bots.

About half of the time, when a website doesn't work with js disabled, I realize that I didn't want to see the page that badly anyway, and I close the tab.

IMO web browser have been enabling all sorts of obnoxious behavior since before JS. One of my all time favorites were the sites that opened pop-ups in a loop faster than you could close them while an audio clip of a guy yelling "Hey everyone! I'm looking at gay porn!" You had to hit reset. Fuck the Web.

The web around the late 90s and early 2000s had some really sketchy stuff. I think the difference is that it used to be the sleazy underbelly. Now it's accepted as mainstream.

My local 'newspaper' website is chock full of scam adverts. The print version is dignified. The website people, somehow, turn a blind eye.

And I got an advert on Youtube this week using sexually explicit language to sell pills.

Feels like standards, and expectations, have really slipped.

Opening a popup needs JS though.

Not with the new popover API.

This doesn't look like it gives websites something they couldn't do before with CSS and JS.

I'm pretty sure it does but maybe I'm wrong, I had never tried to create popovers/popups using CSS. What's neat[†] about the popovers API is that it doesn't need any JS, you just write a couple of HTML attributes and voila, a popover/popup. They will run with JS disabled as well.

https://chrisburnell.com/html-can-do-that/

[†] Neat for me building things like tooltips and dropdowns into my web apps without using JS; not neat for annoying people with popups.

The core trick to making a popover, tooltip, or, really, any kind of overlay element that's anchored to something on the page is putting an element with `position: absolute` inside one with `position: relative`. You can make it display on hover with CSS alone too, if you really want to.

Just curious, why silent sound would allow fingerprinting? What are they sampling if it can't be heard?

The script generates a known waveform, it is passed through the browser's audio implementation and then the script analyses the result after. Based on your devices settings and hardware the output will be different, e.g. a PC with analog output might have 44KHz audio output bandwidth, but a bluetooth headset might have a lower, different audio bandwidth. That is a datapoint that can be used in device fingerprinting alongside screen and viewport dimensions, device pixel ratio, browser plugins, etc.

On the one hand, I wouldn't expect too many variations here (the vast majority of devices probably use 48 kHz and 24-bit output, a few use 44.1 kHz and/or 16-bit, etc.) but just like DPR and all the other properties with a very small set of popular values in practice, you only need a bit or two from each measurement to eventually have a high quality fingerprint.

What surprises me is that this (additional) fingerprinting is actually needed, in the sense of "don't they have enough from everything else"? Also, if I understood this blog post correctly [0], there is only 2 predominant values from this fingerprinting (?).

[0]: https://ritter.vg/blog-webaudio_alibaba.html

I had this (?) happen. I have a soundbar hooked up through spdif in my pc. It automatically switches sources, so I can play music through airplay and then have it play sounds from pc when I open youtube etc. So it switches from airplay music to pc even when nothing is playing on pc. This was happening on some websites and it is extremely annoying.

I wonder if this is something the iOS Facebook app also does? It constantly pauses my Apple Music playing. Soooo irritating.

Somebody (Mozilla?) should make a browser that just proactively blocks shit like this

I’m sure some Adblock addon could do it but at the browser level would be preferred. A browser vendor that just proactively does security and “correctness” tweaks to live sites would actually be in my interests as a user

Aha this would explain. I have seen similar behaviour with a news website trying DRM requests (has no reason to ask this info) resulting in stopping playback.. did not consider the impact of multipoint here. Interesting, might be worth looking into if i see this "bug" again.

90% of this stuff should be illegal

Getting a list of emails from a website by guessing a predictable ID gets your house raided by the FBI and a criminal conviction for accessing a computer without authorization [1]. Why isn't fingerprinting treated the same? And I mean exactly the same - first an FBI raid, arrest, and confiscation of computers, and then they get their day in court.

[1] https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_emai...

I doubt the FBI will be flying to china to knock down any doors! You aren't wrong though, and countries which enforce GDPR I would expect to make noise if this was happening to their constituents.

Is there any particular reason these kinds of APIs are not behind permission prompts?

I thought the App Store review guidelines explicitly prohibit hidden features and using public APIs outside their intended purpose. Is audio-based fingerprinting just not something review can realistically catch?

They probe all audio devices, including microphones, which probably temporarily switches Bluetooth devices into HPF mode due to how Bluetooth duplex audio works.

I'd argue it's "silent" though: aliexpress wakes up my audio card if nothing plays, which results in a very faint "pop" sound every time I open the tab.

It's been this way for ~3+ years at least.

It's the website.

The title of the article literally mentions "WebAudio", and the first paragraph states that the author is using a PC. The second paragraph mentions Chrome and Firefox.

Apple and the App Store have zero involvement here.

This is a huge stretch, but if this problem exists in not only the PC versions of Chrome/Firefox but also the Android/iOS versions, then theoretically the app store reviewers could flag the browsers for facilitating this behavior against app store guidelines. In practice, apps of such caliber as popular browsers might be a bit above such reviewers' pay grade, so to speak.

> This is a huge stretch

This is nonsense. Safari also supports Web Audio. Safari does not, however, support Microsoft Windows, which is why the article author didn't mention it.

Moreover, all web browsers on iOS have to use Apple WebKit, so Web Audio support is not actually the fault of the non-Apple browser vendors.

Right, the article is about the website. I was responding to the comments up there about the iOS app doing the same thing in the background, but I didn't catch the little bit with the reply.

You could make a good case for 'exceeds authorized access' under the Computer Fraud and Abuse Act for this. You might even get some action if you filed a complaint, because it's from China.

We need to find a solution to browsers sniffing on people. This here refers to AliExpress, but which browsers are typically spying on people like that in the first place? That's the real primary problem.

This is actually a really common form of fingerprinting. At one point in time, it could generally tell the website what operating system and CPU architecture you're running on. I know this type of fingerprinting was fixed in Chrome so it always gives the same answers regardless of platform. I think it was also fixed in Firefox and Safari, but I don't follow their releases as closely.

Of course, even though it's probably useless now, things like that hang around because it costs more for trackers to remove the code than it does to keep it in.

I’ve noticed this and on other apps too, it breaks AirPods and when background playing Spotify it’s very obvious.

Thanks for investigating! Makes sense it’s also in the taobao app on ios too.

When I visit an article on a popular German tech news website, it interrupts music playback on my iPad (the website takes audio focus). I bet they do something similar.

Why are web pages allowed by default to do such things? Browsers should give the user the ability to forbid all sorts of thing and have them forbidden by default.

OP please submit the filter to an upstream uBlock filter list.

Will do! edit - How do i do this? through github issues? https://github.com/uBlockOrigin/uAssets/issues

They said they aren't interested

chimed in... thank you for the great documentation!

I am glad people like the write up and it is fostering a conversation! It is such a happenstance that i looked into this.

You can also submit to the EasyPrivacy list or one of the AdGuard lists.

Sounds like we're gonna need browsers to pop an audio playback permission, as annoying as that seems. Abusive sites just can't help themselves.

Cloudflare challenges also use Web Audio, by the way.

Does it hold an audio stream open constantly or just briefly during the challenge? On AE it never stops

Just briefly during the challenge.

Are you not required to grant an explicit permission for it to access audio? If not that is highly disturbing.

I wonder how many other websites are doing such stuff. Lately, KDE Plasma often shows me that audio is being played by Firefox, but no tab in Firefox has the speaker icon. So far, I have not found which page causes this issue (I don't use AliExpress).

This article writing is really clean and enjoyable to read. And I learnt something.

Thank you very much.

This at least partially contributed to a sleep related Firefox bug on Windows:

https://bugzilla.mozilla.org/show_bug.cgi?id=1863193

> screen and viewport dimensions

I remember trying I think it was the Tor browser, being puzzled at why the viewable area of the window constantly changed when resized but would never occupy the full window.

I feel a little silly now.

They have been doing this for months.

No sound playing but the audio would change like the microphone was being activated. I checked permissions to make sure there was no mic access and figured that they were fingerprinting.

I had noticed it before but I was browsing AE a lot today and i got fed up with it. What browser and OS are you using?

It was happening when I was using Chrome on iPhone and Windows 11 with Chrome. I can't remember what was causing it since the headphones (Bose Quietcomfort SE) are synced with both devices. For the last couple of months I've been using Android and I haven't noticed it. The headphones seem to work better with Android. IOS is a bit weird with sharing them with my PC.

I experienced something similar with the AliBaba app. Whenever I had it installed, my Bluetooth devices would only ever send audio in "headset" mode — very poor quality.

Uninstalling the app fixed it up.

I notice this all of the time on sites with ads. I use AirPods to listen to music on my phone at work. Opening websites on my Mac routinely steals the AirPod connection but plays nothing audible.

It's not just BT audio. In windows PC, if aliexpress is opened in one tab in chrome, and switching to a tab with youtube opened, audio don't play in this tab if you start playing youtube.

That could explain the multipoint problems I've had in the last weeks, where audio would get "stuck" to one of my devices even when (apparently) nothing is playing.

I've had these issues on and off as early as 10 years ago when I got my first multipoint headphones.

This is not limited to Bluetooth in any way. In pavucontrol I can see Firefox outputting audio when on AliExpress even though nothing is playing. The uBlock filter fixed it.

> The uBlock filter fixed it.

what filter ?

From the article:

To block the scripts open the uBlock dashboard, select My filters, and add:

    ! AliExpress AWSC fingerprinting scripts
    ||assets.aliexpress-media.com/g/AWSC/uab/*/collina.js$script,domain=aliexpress.com
    ||assets.aliexpress-media.com/g/AWSC/fireyejs/*/fireyejs.js$script,domain=aliexpress.com

I noticed this on AliExpress years ago with cheaper Bluetooth earphones. Actually, all Chinese e-commerce sites activate audio for some reason.

aliexpress is largely a bait and switch site.

most of the prices change during checkout in the most frustrating ways. one u ready to check out, and provide ur payment into, and click to pay... they interrupt this fake checkout with a popover, inform u the price is actually much higher, and dangle a button which is one click to accept the new higher price.

this is total scam behaviour and probably illegal in most US states.

I did not have that experience at all, ordered there dozens of times.

Trying to debug this as a normal user is basically hopeless, you would never think to suspect a shopping tab. Glad someone did the legwork.

It just annoyed me so much that it was interrupting my music!

Hell hath no fury like an inconvenienced power user.

I'm confused, doesn't access to microphone raise pop up asking for permissions? I'm nearly sure I saw it

Perhaps accessing the microphone is something else they do, however that is not the issue in my case nor what my article is about.

This is the reason I use adguard everywhere

I use ublock origin and by default it wasn't blocking, i had to make a custom filter to block the scripts in order for it to prevent the audio takeover. Maybe adguard does a better job? Someone else suggested just wholesale disabling of JS but it is the nuclear option.

There is no legit reason to be doing this.

I dont get how this fingerprints the browser? Are they able to read back the playback of audio somehow?

The Web Audio API has the ability to extract frequency, waveform, and other data from an audio source, that source is generated at runtime on your device. A firefox developer did a further dive into what the WebAudio based fingerprinting can actually return in firefox. https://developer.mozilla.org/en-US/docs/Web/API/AnalyserNod...

Besides the privacy implications, they are also wasting our fucking batteries on this crap...

always a good idea to use NoScript too for more fine grained control.It's ridiculous how many seperate calls a simple web page can make

https://noscript.net/getit/

Bluetooth is such a mess. You know what didn't have this problem? Cables.

Also, non-multipoint Bluetooth.

the fingerprint exists to do dynamic/adaptive pricing... if you never return anything they assume you'll take any price as you enjoy their services more

Getting the same issue when opening Stripe Dashboard with AirPod on.

I think x.com does this too - haven't been able to dig deeper.

This sounds like a GDPR issue no? Couldn't they be taken to the EU!

Yes. In this case probably not fineeprinting is not allowed because not strictly necessary (cookie law) and therefore needs consent from user.

Going batshit with browser APIs is also a formidable GDPR defense. e.g. try browsing the privacy-related forms for Google (https://myaccount.google.com) on Firefox :D (entire browser freezes up every other second for me, because of some extremely important work Google needs to run on my CPU to let me scroll down on a static site containing roughly 30 words)

Can we just limit web APIs to cookies and the likes as before? I don’t like how JavaScript has access to so many devices on the host. It’s a security and privacy nightmare.

> distinguish normal shoppers from automated

Why? Are you afraid of robots making you rich?

Are there any EU/GDPR laws against fingerprinting?

Yes. In this case probably not allowed because not strictly necessary (cookie law) and therefore needs consent from user.

Do we have any jurisprudence on fingerprinting?

Another reason why Lockdown mode on iOS is your friend.

Somebody else mentioned here that they also do it on the iOS app and I don't see how Lockdown mode would change anything, it doesn't prevent to play audio.

Lockdown mode is great, but it breaks phone calls on your Apple Watch (found that out the hard way)

If this wasn't such a serious issue I'd be inclined to make a joke about being surprised that AliExpress was capable of such a thing, but I guess the complete shitshow of a website is intentional.

I wouldn't be surprised if what I'm feeling is all a psychological thing where consumers associate jank with low prices so that's why sites like AliExpress and Temu look like a complete technical mess when in reality they're doing pretty advanced stuff like this.

Now, that's why leaving some sites in background empties my phone battery.

Meanwhile ppl freak out over Anthropic using timezone and Unicode for the same purpose, without realizing Chinese are simply ruthless in abusing iOS or Android or Web. Pinduoduo, who owns Temu, is infamous for exploiting an Android 0day vulnerability for such purposes.

Reply on news.ycombinator.com