Link: https://beyondmachines.net/event_details/aliexpress-silent-webaudio-fingerprinting-uses-bluetooth-hardware-9-o-c-m-i/gD2P6Ple2L

Archived version

If you shop on AliExpress and your Bluetooth headphones stop switching between devices, this is caused by hidden tracking scripts on the site, not broken hardware. Install uBlock Origin and add filter rules to block collina.js and fireyejs.js on aliexpress.com, then close all open AliExpress tabs and reload the site for the fix to take effect.

...

AliExpress users report a privacy-invasive tracking mechanism on the company's homepage that interferes with Bluetooth hardware. The site runs hidden audio processes that prevent multipoint headphones from switching between devices. This behavior occurs even when the tab is idle and no media is visible to the user. The issue is caused by Alibaba's security scripts designed for device identification and anti-fraud detection.

...

Anti-fraud detection? The entire company is built on selling lies and deceit =/

Doesn't the website need to ask for microphone permissions first?

I think one company I worked for was nearly wiped out in the startup phase by someone there taking almost all the money the company had and then disappearing without delivering the components they needed

Firefox hardened against this fingerprint method a couple years ago reportedly.

It's playing inaudible audio, not recording.

Modern browsers are a mistake, aye?

But doesn't it need to record the audio to do any kind of fingerprinting?

If I understood it correctly, it only checks how your hardware reacts to audio being played.

Meh, it's not just or even especially the browsers.

First of all, AliExpress did a thing here, not your browser.
And if your browser didn't have the capability to basically work as a small multimedia machine inside your machine then they'd find other ways to achieve similar things.
Unless of course your OS setup makes such things impossible, as any sane OS should.
Microphone access to any app, any site, without asking? That's madness.

Isn't that just "no unrestricted access to microphone or camera"?

Seriously though: shouldn't one just use a browser/OS combo that makes it impossible to give such unrestricted access to peripherals without asking?

The browser allows it. It could put up a notification "allow access to speakers". It should do so with the mic.

I once tried a website that shows much web browsers reveal about you and your system... it's crazy how much his activated by default.

Which website?

Once again, it depends on the browser and the OS, which ultimately governs the hardware.

I can't remember. Someone shared one here on the fediverse and I didn't bookmark it. There are alternatives:

• https://www.browserscan.net/
• https://coveryourtracks.eff.org
• https://amiunique.org/fingerprint
• https://everysiteknows.ferrucc.io/

Try it on your desktop and on your mobile.

90+% use chrome, so guess what the browser knows about you....

It's fingerprinting your system to gain information about you that way,, not through listening in on you in real space.

https://ritter.vg/blog-webaudio_alibaba.html

Thank you!