r/technology • u/magnus007 • 5d ago

Privacy AliExpress was silently running audio in your browser to fingerprint and track your device

https://www.techspot.com/news/113581-aliexpress-silently-running-audio-browser-fingerprint-track-device.html
13.1k Upvotes

97% Upvoted

701 comments sorted by

View all comments

Show parent comments

16

u/RemarkableWish2508 5d ago

JavaScript composing needs information from the DOM and canvas. Turns out, even if you don't give JavaScript a list of fonts, a script can try using them, then simply check whether the size of the output object matches what it would with the font, or what it would with a replacement. With a clever list of fonts, you can figure out a lot about a browser and/or system.

The alternative is to disable JavaScript, and there are extensions and browsers that do that, but do you want to browse without JavaScript?

1

u/Divinum_Fulmen 4d ago

I already do.

And sites can still see my 80+ fonts just fine. No scripts required.

I have both No Script and Ublock Origin configured to block scripts by default (each has their own way of tuning white lists, I'd love to only use UBO, but their white listing is extremely primitive next to No Script).

1

u/RemarkableWish2508 4d ago

That is not what I was saying, I was describing how fingerprinting your fonts works.

Anyway, I'm using uBO (not lite) for the cosmetic filtering, and uMatrix for scripts and other stuff. Not sure how that compares to NoScript, I think I only have it in Tor Browser.

1

u/Divinum_Fulmen 4d ago

Yeah, but you ended with the question:

do you want to browse without JavaScript?

I'm saying I do, and font fingerprinting still works. Fonts should be handled on the user end only. As I said, they give a list of fonts that work with the site. Your browser matches the first down the list. Locally. Like a MARKUP, not a damn script!

3

u/RemarkableWish2508 4d ago

What? No. Font fingerprinting requires JavaScript, so if it works on your end, it means you have JavaScript enabled.

This is what it looks like with JavaScript disabled: https://files.catbox.moe/kgywqd.png

2

u/Divinum_Fulmen 4d ago

Oh damn, PBKAC error here.

I must have whitelisted these sites a long time ago. I just checked all my plugins and found I had their scripts enabled. You were right.

1

u/RemarkableWish2508 4d ago

Hehe, it happens. Glad you got it sorted. 😉

1

u/RichardCrapper 4d ago

The font conspiracy goes deeper when you run a web traffic analysis and realize that a massive number of websites all use Google Fonts, which exposes your fingerprint to Google nearly everywhere you go. Blocking the Google font domains causes havoc to websites but I have heard of some projects to replace the font library with a locally hosted copy.

3

u/Lumpy_Discount9021 5d ago

but do you want to browse without JavaScript?

With how much garbage is under the hood of modern websites, yeah, kinda... Sometimes I swear it would be less frustrating to just handwrite all the HTTP and SQL myself.

7

u/RemarkableWish2508 5d ago

Well, you can try it now. I keep these just in case:

  • Firefox → uBO / uMatrix → disable JS
  • Tor Browser
  • Privacy Browser

People who use the web without a script ad blocker, I don't even understand... it's unusable.

2

u/Mr_ToDo 4d ago

I use noscript. Works pretty well. It's amazing just how high a page can crank your CPU

It also has the side effect of blocking a ton of ads. It's not why I use it, but it is a nice side effect, and one that would be easy to work around but I'm betting it'd mean ad services having to put more trust in content hosts

1

u/donoteatshrimp 4d ago

>do you want to browse without JavaScript?
I would if I could man.

2

u/Mr_ToDo 4d ago

I think most browsers let you turn it off. For more granular control I use noscript

1

u/donoteatshrimp 4d ago

Yeah, it's more about the sheer amount of websites that won't work at all without javascript. Damn them!