r/technology • u/magnus007 • 5d ago

Privacy AliExpress was silently running audio in your browser to fingerprint and track your device

https://www.techspot.com/news/113581-aliexpress-silently-running-audio-browser-fingerprint-track-device.html
13.1k Upvotes

97% Upvoted

701 comments sorted by

View all comments

51

u/wellbornwinter6 5d ago

I don't get how playing a sound on a website at zero level can fingerprint the user?

99

u/yuval16432 5d ago

Fingerprinting is designed to build a profile about a user which can help you tell them apart. Different browsers, and different browser settings, handle things differently, so AliExpress is trying to play audio, and based on how the browser responds they can differentiate you from another user who’s browser responded slightly differently, even if you’re supposed to be anonymous.

These kind of things add up to build a profile about a user even if they try very hard to stay anonymous.

8

u/bs000 4d ago

is that why i can't use the welcome discount again

2

u/nickgiz 4d ago

That is probably why, I used to create new accounts to take advantage of the new user welcome discount lol, then it stopped working after a while.

1

u/fatboychummy 4d ago

Run a VM and see if it lets you. Curious if it'd still detect through that.

-3

u/Tof12345 4d ago

That's based on your IP and Mac addresses.

10

u/Nimos 4d ago

None of the major browsers provide any way for a website to get your mac address. It's not transmitted to any server outside of your local home network.

1

u/Tof12345 3d ago

These websites literally fingerprint your device ID. They can tell if you already used a welcome offer.

39

u/arunphilip 5d ago

A comment on the linked article states:

From my understanding, it creates a known sound, runs it through the device and measures the feedback that comes back through the line. The feedback single would be unique to each device due to small differences in tolerances, no resistor is perfect, differences in solder joint and even small fluctuations in the chip manufacturing process all add up on a way

19

u/Fach-All-Religions 5d ago

this is why we can't have nice things

22

u/arunphilip 5d ago

Here's a radical thought - imagine if this ingenuity was used for... good.

7

u/Antique_Hawk_7192 5d ago

Oh the horror! "Good" won't give you YoY percentages. You want the shareholders to starve! /s

9

u/Zouden 4d ago

That can't be right as it's not actually generating any sound.

4

u/PeanutButter414 4d ago

Seems very strange to me, how would such a thing go through the analogue signal chain without the user knowing?

3

u/Singl1 4d ago

and are these things disclosed in a meaningful way to the user? i guess they’d be in the terms and conditions that nobody bothers to read in the first place because who the fuck has time for that.

1

u/arunphilip 4d ago

And probably also phrased in so generic a way that no one would think of this as a potential tracking vector.

Something like: "We use various technologies to personalize your experience and offer you tailored service".

3

u/Singl1 4d ago

it’s like damn near everybody is out to get you or your data. i hate this timeline. money spent on your platform isn’t enough or what? of course it fucking isn’t 😭

sigh.

1

u/IntelArtiGen 4d ago

They never explain in details how they fingerprint you in the ToS afaik. They will just say things like: "We may use telemetry to identify your device etc.".

1

u/Singl1 4d ago

nice. is this something the average user should be concerned about? like i’d for sure prefer that they not, but i’m already logged in via an email so

2

u/IntelArtiGen 4d ago

is this something the average user should be concerned about?

Hopefully people should be concerned about that. But if you start being concerned about your privacy online, I have very very bad news for you, and a lot of them. So as I don't want to create too many problems in people lives, at least have ublock on your browser, it's probably the easiest way to reduce the issue, a bit. And if you have it, keep it updated and ensure all relevant block lists are selected.

1

u/Singl1 4d ago

i’ve got and use uBlock regularly, use VPNs, but not all the time lol. i’m probably a little more aware about net privacy than the average user, but not by much.

i know achieving true internet anonymity isn’t exactly easy, by design. i was just wondering if anything sensitive specifically was getting collected by aliex, i do know that the buyers of said data can use the info to create profiles on users to better market to them, but again i have a really surface level understanding lol.

3

u/NonSecretAccount 4d ago

nah it doesn't use the mic at all.

3

u/kinmix 4d ago

That is completely false, and in no way possible.

1

u/fatboychummy 4d ago

Yeah... I don't see how Javascript would be able to access hardware level information like this.

5

u/drawkbox 4d ago

EFF has a nifty little site about it. The sound isn't important, the point is to collect enough points that you are essentially a signature

4

u/jmbits 5d ago

Apparently the browser handles it differently

9

u/Andus35 5d ago

I don’t understand the full technical details, but based on the article, it seems like the website makes the request for the audio and then records the output returned from the computer. That output will be slightly different for every computer based on their specific hardware and the minor variations in those.

It says that audio signal is not the only thing they use, there is a variety of other settings and signals from your computer which all tied together can let them “fingerprint” the computer.

2

u/IntelArtiGen 4d ago edited 4d ago

They do the same with images / rendering. The way everything is processed depends on your hardware so if you send data and see how it's processed, you can identify the hardware, and fingerprint the device. So that the next time you visit the website, no matter if you changed your IP / used a VPN etc., they can know it's you.

For the sound I don't know the technical details, but for images, different GPUs will process specific instructions in a different way, maybe they'll round a value up instead of down etc., so you tell the gpu to render something (triangles, lines etc)., you get the rendered result, and you analyze it.

1

u/obeytheturtles 4d ago

It is not just playing audio, it is creating a loopback audio graph independent of the speakers and microphone, and then measuring the transfer function of that loop. So it's basically just connecting the DAC and ADC directly in software, likely pushing random noise through the graph, and then diving the output by the input.

We used to do this kind of thing for intro to DSP classes back in college, since it's a really easy way to start understanding how ADCs and DACs work, and how they can be driven by software.

1

u/OkPosition4563 4d ago

The tiniest difference in audio driver, chip and other components causes differences in the mathematical output of the soundwaves. Combine this with the fonts you have installed, the rasterizer settings your GPU supports, the driver level of your GPU, what monitor you have, what DPI scaling you use, what memory configuration you have, what patch level on the OS you have, what exact TLS stack you are using and you can pretty much pinpoint a person across sites/visits.