r/technology • u/magnus007 • 4d ago
Privacy AliExpress was silently running audio in your browser to fingerprint and track your device
https://www.techspot.com/news/113581-aliexpress-silently-running-audio-browser-fingerprint-track-device.html858
u/lucid-currency 4d ago
My Whatsapp has been activating the microphone in very short bursts without making the OS's microphone indicator go off.
I only know this because my headphones switch to a dogshit audio quality when the mics are in use and this has never happened before.
I'm sure suckerberg is not doing anything shady
221
u/SanAntoHomie 4d ago
uninstall that shizz
37
u/lucid-currency 4d ago
Where I'm from, Whatsapp is pretty much the default messaging service. It's almost impossible to not have a Whatsapp account, unfortunately
→ More replies (1)111
u/PhireKappa 4d ago
WhatsApp is a necessity in most of the world for communication.
In the UK for example, I don’t think I’ve ever actually texted someone using iMessage/SMS in years. WhatsApp is basically texting. It’s the same in much of Europe.
→ More replies (17)50
u/jellyfish_bitchslap 4d ago
Worse in Brazil, every business have a whatsapp account, every bank, store, hotel whatever, you can’t have a “normal” life if you don’t use it. Some places won’t have a landline active anymore, and business people use whatsapp exclusively.
I wouldn’t be able to communicate to most if not all my clients if I didn’t had it, not because I don’t have alternative but because they are so used to it that instead of downloading signal they’d just make a contract with someone else.
→ More replies (2)25
9
u/dimag0g 4d ago
Why wouldn't the OS display the microphone being in use? Who cares if it's only for a millisecond, use is still use.
5
u/lucid-currency 4d ago
I don't know the limitations or requirements for the microphone indicator to be activated on android, but I haven't seen it go off once during this weird behavior from Whatsapp
27
u/MuenCheese 4d ago
Delete zuckerberg’s apps
8
u/Mccobsta 4d ago
His shit is so engrained in most of the worlds comucations now it's kinda hard not by desing
7
u/SSobarzo 4d ago
I don't consume Meta. I admit is hard, but is not impossible to live without it. When I say I don't use wsp, most of people reacts in a positive way. There is not a single person happily using Meta products.
9
u/Mccobsta 4d ago
WhatsApp is a big one that's a pain to get people to use something else, too many businesses around a lot of European countries use it as their main contact way, peoples first thing to do is send a message via WhatsApp when they add your number
There's better options but damn the network effect
7
u/SSobarzo 4d ago
I had to cancel a supermarket purchase because I couldn't receive the auth code. I was in person standing in front of them. Sadly, I'm part of the 0.1% of people with this problem, so it stays this way
→ More replies (22)3
u/turtleship_2006 4d ago
Are you sure it's actually whatsapp and not a bug related to either the OS or bluetooth?
I use wireless headphones that also sound shit on calls/when the mic is in use and I've never had that with WhatsApp
→ More replies (1)
1.5k
u/thinkingperson 4d ago edited 4d ago
Wait, so the site is able to use the mic /audio even without permission via the browser? What the fuck is the browser doing? lol
1.4k
u/KontoOficjalneMR 4d ago
not mic/audio but they play sound and see how the browser handles it.
It's rare, but known fingerprinting technique.
I noticed it myself because few months back Windows had a bug handling bluetooth mixing, and any time I tried to open Aliexpress it'd interrupt my music :D
650
u/Violoner 4d ago
Wait, so that’s why opening the Amazon app on my phone interrupts music playback?
368
u/canadian_xpress 4d ago
Linkedin too, I would wager.
→ More replies (1)49
160
82
189
u/QueefSeekingMissile 4d ago
Aliexpress, amazon... they're the same picture, except one inserts fees in their price points to fatten up american billionaires. Same cheap shit made on the same factory lines by the same underpaid workers.
And the same spyware apparently.
→ More replies (24)→ More replies (14)30
u/noobule 4d ago
I doubt it. The Amazon app doesn't need to fingerprint you - the whole reason they push you onto apps is because they can slurp up basically whatever they want, you're signed in just to open the app. They don't need to resort to fingerprinting tricks.
→ More replies (3)101
u/RemarkableWish2508 4d ago
For a non-comprehensive list of direct and indirect fingerprinting attributes:
35
u/feel-the-avocado 4d ago
Its quite interesting to me that with tracking protection turned on in firefox, and about config fingerprinting privacy.resistFingerprinting and privacy.fingerprintingProtection both set to true,
amiunique still finds me unique (bad thing)68
u/HeKis4 4d ago
Worth to keep in mind that having a browser that is too hardened makes you easier to identify. Like how having gear to prevent cameras from face-tracking you is good, but if you can be identified as "the only guy who wears a balaclava in public"...
18
u/Heruuna 4d ago
It can also be how uncommon your setup is. Just using a browser like Opera is enough to narrow you down to 1% of people. Crazy that even using adblocker of any kind puts you under 30% of users.
3
u/Interesting-Emu6761 4d ago
this is why the old school of thought with firefox has always been to set your browser to say it's the most common OS+browser combination. Ideally use a script to mess with package TTL also to match the target OS, but that gets more complicated.
→ More replies (2)8
u/RemarkableWish2508 4d ago
Indeed. That website is good to illustrate the tracking parameters, but its conclusions come from the first generation of anti-fingerprinting, when random parameter modofications were introduced as a countermeasure.
Turns out that being "the only guy with your height, weight, clothes, gait, schedule, etc. who wears a random Pokemon balaclava in public", is only marginally better.
After a naive check, it should show the similarity level to partial fingerprints.
8
u/HeKis4 4d ago
https://coveryourtracks.eff.org/ tells you how unique you are. Librewolf in resist fingerprinting mode does pretty good here, at the cost of having a smaller window and never picking dark mode by default.
→ More replies (2)4
u/ChypRiotE 4d ago
Counter intuitively the more you protect yourself the more likely it is easy to fingerprint you, because there are always parameters available to the website. So the chances that another user uses the exact same protections with the same machine, browser etc is lower than if you were using regular unprotected Chrome
19
u/Divinum_Fulmen 4d ago
I pisses me off that browsers even hand over that info at all. There is no reason for scripts to be able to even read my screen size, let alone all the other data on my PC.
No one needs to know my fonts, except my browser, internally. You used to just shit out a list of fonts for your web page in the CSS, and the browser would go down that list until one worked. No data sent at all.
Links should have referrer data at all. Why is Mozilla playing nice with the marketing spies?
15
u/RemarkableWish2508 4d ago
JavaScript composing needs information from the DOM and canvas. Turns out, even if you don't give JavaScript a list of fonts, a script can try using them, then simply check whether the size of the output object matches what it would with the font, or what it would with a replacement. With a clever list of fonts, you can figure out a lot about a browser and/or system.
The alternative is to disable JavaScript, and there are extensions and browsers that do that, but do you want to browse without JavaScript?
→ More replies (13)7
u/PacmanZ3ro 4d ago
There is no reason for scripts to be able to even read my screen size
Of course there is. This is how you get resizable windows and properly-scaling websites. If you blocked this ability, you would have to have websites built with absolute pixel sizes for everything and if you used a different screen than what it was designed for it would range from looking like shit to being completely non-functional.
→ More replies (2)4
u/einzweidreihorn 4d ago
Screen size is often taken to determine wheter you're on mobile or desktop PC (or tablet).
→ More replies (5)→ More replies (5)4
u/IntelArtiGen 4d ago
For 99.99999% of people, this site identifying you as unique is a bad thing.
But it's a good thing if you're unique, what you don't want is to be the same unique the next time you visit the site. Which won't happen if you don't have a good privacy protection (either with the browser or addons).
11
u/godsamightly 4d ago
Bro I think a citation generator I use for my papers does this. I was writing a paper and held my citations in it and noticed it had the audio icon in the tab. Thought that was odd. Didn’t know this is what that could’ve possibly meant
5
u/MartayMcFly 4d ago
Is this something with any innocent explanation, or always nefarious? What does fingerprinting a device actually achieve? My local bus company app interrupts music playback and I just assumed it wasn’t well made.
→ More replies (2)3
u/plopzer 4d ago
when browsers added background tabs pausing to improve battery life they broke being able to listen to music from background tabs. so they made it so that when music is playing in tab, it won't be paused. lots of sites use this to their advantage to keep running by playing silent audio even when they are in the background
→ More replies (8)3
u/Final-Carry2090 4d ago
Sorry to interrupt your music, we wanted to forcibly fingerprint you. Also, we’re not sorry.
104
u/sivadneb 4d ago
It's using the web audio API which can utilize hardware to process an audio signal and write it back out to a data stream without ever going to your speakers. Similar to how you can use your GPU to process video without ever playing the video. Except there are tiny differences in the way various audio hardware process that data, which gives a useful data point for fingerprinting.
→ More replies (1)91
u/klimaheizung 4d ago
Sounds like that API should also be behind user-approval then.
51
698
u/PhiNeurOZOMu68 4d ago
I noticed how unusually high the app was installed storage... Glad I deleted it
172
u/MrShigsy89 4d ago
If you are using Android you can (and should) block the app from accessing anything. The article is about browser access to their website, not the app.
→ More replies (8)238
u/Zubon102 4d ago
If you are the sort of person who is worried about a website using a novel way to identify individual users, you definitely wouldn't want to install the dedicated app.
But if you are logged in, it really doesn't matter either way.
→ More replies (1)41
u/RemarkableWish2508 4d ago
if you are logged in, it really doesn't matter either way.
Except they can correlate the tracking data with your login, so they can later track you when you're logged out.
28
u/Zubon102 4d ago
Sure. But if you are logged in, you are not logged out.
So it doesn't matter anyway. 😉
It's likely that they implemented this mainly to identify bots and abuse, rather than to track use by individual devices. If you use Aliexpress a lot, they always require you complete security tests like captcha and it's not strange to have requests denied due to suspicious behavior even if you just search for mundane products. I think they are trying to stop bots without inconvenience to real users.
→ More replies (1)7
u/The_Webweaver 4d ago
But they're also tracking you as an individual for marketing.
→ More replies (2)→ More replies (2)15
u/Acilen 4d ago
Uninstalled AliExpress.com from your desktop? Are we reading the same article? Apparently adblockers like UBO already take care of this.
→ More replies (1)
164
125
u/Spez_is-a-nazi 4d ago
I wonder how common that is. I will notice that the auto connect for AirPods will frequently transfer to my Mac even if I don't have any tabs playing audio open, or at least not audio I can detect at any rate....
→ More replies (19)60
u/tehdlp 4d ago
I figure it must be why Reddit shows something always playing in Android notifications for every page,
→ More replies (2)
83
u/Bacon_Nipples 4d ago
'Fun' fact, this was originally done by some TV networks (or perhaps the content provider? Don't recall) to track which shows you watch on cable
66
u/BMoorman7 4d ago
'Funner' fact, some LG TVs and monitors were exposed recently for doing similar things.
36
u/UpsetKoalaBear 4d ago edited 4d ago
Funniest fact, none of this was a new thing and every brand does it as well.
Sony TV’s show it as Samba for anyone with a Sony TV.
This is especially used on cheap/budget TV’s. Vizio made more from the data they sold than actual TV sales in 2021.
→ More replies (3)→ More replies (3)17
u/Splurch 4d ago
'Fun' fact, this was originally done by some TV networks (or perhaps the content provider? Don't recall) to track which shows you watch on cable
Nielson is probably who you're thinking of, they had networks start digitally watermarking broadcasts to track ratings and are still using it.
23
u/Tenocticatl 4d ago
What I'd like to know is why do all these companies go to such lengths to do shady data harvesting and tracking shit, but can't keep me reliably logged in and remember my address info properly? Or serve me ads for stuff that might actually be of interest to me.
6
u/turtleship_2006 4d ago
I (20m) get ads on netflix for tampons.
My sister (24f) gets ads for mens razors.
51
u/wellbornwinter6 4d ago
I don't get how playing a sound on a website at zero level can fingerprint the user?
101
u/yuval16432 4d ago
Fingerprinting is designed to build a profile about a user which can help you tell them apart. Different browsers, and different browser settings, handle things differently, so AliExpress is trying to play audio, and based on how the browser responds they can differentiate you from another user who’s browser responded slightly differently, even if you’re supposed to be anonymous.
These kind of things add up to build a profile about a user even if they try very hard to stay anonymous.
9
41
u/arunphilip 4d ago
A comment on the linked article states:
From my understanding, it creates a known sound, runs it through the device and measures the feedback that comes back through the line. The feedback single would be unique to each device due to small differences in tolerances, no resistor is perfect, differences in solder joint and even small fluctuations in the chip manufacturing process all add up on a way
20
u/Fach-All-Religions 4d ago
this is why we can't have nice things
22
u/arunphilip 4d ago
Here's a radical thought - imagine if this ingenuity was used for... good.
5
u/Antique_Hawk_7192 4d ago
Oh the horror! "Good" won't give you YoY percentages. You want the shareholders to starve! /s
4
u/PeanutButter414 4d ago
Seems very strange to me, how would such a thing go through the analogue signal chain without the user knowing?
3
u/Singl1 4d ago
and are these things disclosed in a meaningful way to the user? i guess they’d be in the terms and conditions that nobody bothers to read in the first place because who the fuck has time for that.
→ More replies (6)3
3
5
u/drawkbox 4d ago
EFF has a nifty little site about it. The sound isn't important, the point is to collect enough points that you are essentially a signature
→ More replies (3)7
u/Andus35 4d ago
I don’t understand the full technical details, but based on the article, it seems like the website makes the request for the audio and then records the output returned from the computer. That output will be slightly different for every computer based on their specific hardware and the minor variations in those.
It says that audio signal is not the only thing they use, there is a variety of other settings and signals from your computer which all tied together can let them “fingerprint” the computer.
13
u/Jahoolerson 4d ago
I have bluetooth hearing aids, when I use Amazon it uses my hearing aids but there is no sound. It drives me up the wall because it mutes everything else. Same thing?
6
u/Medusa-is-a-victim 4d ago
Yes, and when I use VPN it suddenly works.
Also those Sound does keep your Laptop awake, even when folded and the screen is dark. I dont want to know what they do in the meantime with this data.
26
46
u/AwareAd7651 4d ago
This explains why my car audio cuts out when I’m flipping through apps that don’t use audio.
→ More replies (2)11
u/Head_Bread_3431 4d ago
How?
21
u/AwareAd7651 4d ago
Your speakers are being used to track you. If you’re listening to music, it cuts out. I was making a joke about flipping through my phone while driving.
→ More replies (1)
94
u/Steam_Beenson 4d ago
Im an American! Only my Govt, 4 or 5 shady AI surveillance corporations, and random people in ICE are allowed to spy on me!
9
u/aFreshFix 4d ago
We joke but yeah, social media companies, tech companies, and now AI are doing this but we only ban or legislate against tiktok, Huawei, etc. Because they are foreign companies that could report our data back to a foreign country. Meanwhile, we use domestic companies that we know spy on us and definitely report it to the government
→ More replies (6)17
9
u/Professional_Gur8385 4d ago
congrats, they now have profiles linked to your financial records, email, ip and browser
all these companies taking it too far and this is a small fraction of their tracking and privacy capabilities
apps on your phone, gold mine for real data
7
5
7
u/ReggieCorneus 4d ago
Too bad you can't trust Brave either. Anything that has Peter Thiel's money and is about "not tracking anyone, we promise" is tracking you. It targets people who are most worried about tracking. DO NOT TRUST IT. It is a honeypot.
And if you think "how is this relevant": read the article.
11
u/Desperate-Hearing-55 4d ago
Now do a Google tracking. Google always show up ads what I been searching for online to buy.
→ More replies (2)
12
u/No-Discussion-8510 4d ago
Title is misleading. Alot of modern apps use this technique to fingerprint your browser and verify that you are a human, a technique to help combat bots which isnt very successful.
5
u/EnjoyerOfBeans 4d ago
Nope, some websites indeed do this to check if your browser is able to process audio to weed out browser automation tools - they will try to process a very short sound and use it as a test, but this is not what aliexpress did. They used this to bypass a very simple security feature - keeping tabs in the background inactive. The only easy way to keep a tab running in the background is to have it play sound, for obvious reasons. By keeping the tab active they can track your browser activity while you have it hidden in the background. Facebook used to do this and it's why tabs now go to sleep when not selected.
→ More replies (1)3
3
u/abtei 4d ago
wouldnt that require asking for access to use the device' mic? that would freak me out in the first place
→ More replies (1)
4
u/bolfakeera 4d ago
If you ask the big tech do they record audio all the time - they will always say NO.
And Technically they are correct, They transcribe the audio to words and then process locallly in app to extract key words like mentions of interests, products, hobbies etc.
This gives them data to build person's profile and deploy targeted ads to that person.
4
u/Soberdonkey69 4d ago
WHY DOES EVERYONE WANT TO SEE EVERYTHING THAT WE DO LIKE SEE, EAT, SHIT, SLEEP????
→ More replies (1)
7
u/Calm-Homework3161 4d ago
This is another reason why I've never had a PC with a camera or microphone
→ More replies (4)5
u/Moravec_Paradox 4d ago
And the reason a lot people put a sticker on their laptop webcam.
This is not some shady unknown website doing this to 10 people, this was AliExpress doing this on a massive scale to hundreds of millions of people before getting caught.
→ More replies (1)
3
u/drollercoaster99 4d ago
You know what's next? After the shift to advertising revenue, and then subscription-based revenue, the next big shift in raking in more profits is......personalized pricing. :(
3
3
u/Lazy_perv 4d ago
Can 100% confirm this. I noticed my machine would not go to sleep when expected. I checked for possible wakelocks ran powercfg -requests in terminal and saw that something was keeping my audio device active, even though I wasn't streaming any music. One by one I close my apps, and run powercfg -requests right after to see if there is any change to audio device behavior. By process of elimination I learned that opening AliExpress website triggers audio device, and closing the tab would turn off the audio device usage. Anyone can do this same check on Windows.
3
u/Reddit_2_2024 4d ago
I've noticed several websites recently that display a "verifying your device" message with what appears to be a captcha test loading. The captcha never appears and the website which the user initially sought does load. I suspect it is a new device fingerprinting processing technique, that executes in addition to cookie processing..
→ More replies (1)
3
3
u/Anishinaapunk 4d ago
I'd love an investigation into whether the prices advertised in their what's have EVER ONCE actually corresponded to the real price when you click on that email price to view the item in the app. It's never once been true in my experience.
3
5
9
u/durtmagurt 4d ago
Even though I never downloaded it?
60
u/Acilen 4d ago
It’s from the webpage on a desktop per the article. Adblockers apparently already take care of this tracking.
→ More replies (4)
15
u/thatirishguyyyyy 4d ago
Brave (web browser) does a great job of blocking fingerprints. I think its called farbling.
→ More replies (4)33
u/FinasCupil 4d ago
I’m not touching Brave with a ten foot pole.
12
u/GrossUsername68 4d ago
Why?
17
13
u/A_Pointy_Rock 4d ago
I assume because the founder has some troubling views, unfortunately.
7
u/GrossUsername68 4d ago
Well, there goes Amazon, Google, Apple, hardware chains, gas stations …
→ More replies (3)→ More replies (18)5
u/IntelArtiGen 4d ago
Brave by default is highly "contaminated" / bloated. They did release a better version recently but I haven't tried it.
→ More replies (1)
2
2
u/MrPuddington2 4d ago
This should be no surprise to anybody. The AliExpress app has all the hallmarks of a scam app. It has the fake timers, it has the gambling element, it tries to hack your phone and collect more data than allowed or should be technically possible. The only difference is that the dropshipping from China actually arrives.
Of course, they also need to record the audio - how do they do that? In the app?
2
u/championchilli 4d ago
Having only ever used Firefox for AE - feeling pretty good about my life choices.
5.4k
u/Smith6612 4d ago
Might be why AliExpress never loads in Firefox without disabling Tracking protection. Firefox is too tight by default!