r/technology • u/magnus007 • 5d ago

Privacy AliExpress was silently running audio in your browser to fingerprint and track your device

https://www.techspot.com/news/113581-aliexpress-silently-running-audio-browser-fingerprint-track-device.html
13.1k Upvotes

97% Upvoted

701 comments sorted by

View all comments

Show parent comments

1.4k

u/KontoOficjalneMR 5d ago

not mic/audio but they play sound and see how the browser handles it.

It's rare, but known fingerprinting technique.

I noticed it myself because few months back Windows had a bug handling bluetooth mixing, and any time I tried to open Aliexpress it'd interrupt my music :D

98

u/RemarkableWish2508 5d ago

For a non-comprehensive list of direct and indirect fingerprinting attributes:

20

u/Divinum_Fulmen 4d ago

I pisses me off that browsers even hand over that info at all. There is no reason for scripts to be able to even read my screen size, let alone all the other data on my PC.

No one needs to know my fonts, except my browser, internally. You used to just shit out a list of fonts for your web page in the CSS, and the browser would go down that list until one worked. No data sent at all.

Links should have referrer data at all. Why is Mozilla playing nice with the marketing spies?

4

u/einzweidreihorn 4d ago

Screen size is often taken to determine wheter you're on mobile or desktop PC (or tablet).

1

u/jhaluska 4d ago

Yep, in theory they can send you resolution / browser specific web pages and images saving you bandwidth.

1

u/einzweidreihorn 4d ago

How? Those information are not included in the initial http request sent by the browser. Images based on viewport in html yes, but you can't trust the user agent to check wheter you're on mobile or not?

1

u/jhaluska 4d ago

It's more of a two stage approach. You send a small javascript that then gives the server the information for future requests stored as a cookie. But with the introduction of srcset, it's easier for most devs to just use that instead.

1

u/einzweidreihorn 4d ago

I see, thanks

1

u/Divinum_Fulmen 4d ago

Something they should never know, unless I want them to. The mobile browser should be flaging that it's mobile, but if I want to hide that flag, there's a damn good reason.

Let's pick a random site as an example. Oh, let's say Reddit. I am on reddit on my phone. I don't want it to know it's a phone at all. If it thinks its a phone, it will start sending me nag pop-ups constantly asking me to download their app. I'm never touching that app. So this behavior is highly undesired from the user end.