Link: https://sh.itjust.works/post/65659074

This was posted to cybersecurity and I am not sure how to make a proper crosspost. Or even if that is a thing I can do. So just dropping a lemmy link in the url. Hope that is OK. The external link is here -> https://www.malwarebytes.com/blog/privacy/2026/08/aliexpress-caught-using-silent-audio-to-fingerprint-visitors-browsers

Given how much fingerprinting relates to privacy, seems related for this group too. Yet Another Fingerprinting Technique. It doesn’t record the user, just a silent signal which still has variance due to the unique device.

researchers and browser maker Brave reported finding silent Web Audio processing on the site that could help fingerprint visitors’ devices.

on top of that, the traditional fingerprinting signals are used too,

The scripts also gathered information tied to canvas rendering, WebGL, display settings, hardware configuration, WebRTC behavior and user interactions. Together, those signals can create a more detailed profile of a device than any one signal would provide on its own.

Can't read the page but presumably that requires microphone access?

I'm not 100% sure but the original link says

The audio processing did not record people through their microphones. Instead, it generated and processed an inaudible signal, then measured small, repeatable differences in the way a browser and device handled it.

Oh! They have a link to this -> https://ritter.vg/blog-webaudio_alibaba.html

Which makes it sound less scary, and not very effective against FF with fingerprint protection turned on. FF is working on mitigating it. Maybe Chrome and Safari can protect too. But it's also not quite a nothing-burger. Even a weak signal, is useful b/c lots of weak signals combine into a strong signal.

Everything contributes to the fingerprint. Even if everyone falls into say 2 buckets, that's still one bit you didn't have before.

Apparently not, and it works when the device's audio is muted.

The AliExpress website was found processing a fixed audio waveform and examining the resulting numerical values. Tiny differences can arise from the browser, operating system, CPU behavior, audio hardware, and drivers. When combined with other signals, they become another input that can contribute to a browser or device identifier.

Investigation of the page’s code reportedly found audio-processing graphs that were set to zero volume but remained connected to the system audio output. That explains why a user could hear nothing, and why muting a browser tab would not necessarily prevent the processing. All the relevant work was occurring within the Web Audio graph rather than through a conventional media player.

Apparently not, and it works when the device's audio is muted.

The AliExpress website was found processing a fixed audio waveform and examining the resulting numerical values. Tiny differences can arise from the browser, operating system, CPU behavior, audio hardware, and drivers. When combined with other signals, they become another input that can contribute to a browser or device identifier.

Investigation of the page’s code reportedly found audio-processing graphs that were set to zero volume but remained connected to the system audio output. That explains why a user could hear nothing, and why muting a browser tab would not necessarily prevent the processing. All the relevant work was occurring within the Web Audio graph rather than through a conventional media player.

Getting to the point where we go back to cash and have a safe installed in our house ...

Fingerprinting can be used for legitimate purposes such as fraud prevention, bot detection

No. No no no.

If you're fingerprinting to try to detect bots, you're the baddie.

We have to protect ourselves. So if you can't uniquely fingerprint me, it doesn't mean I'm a bot. It means I don't let you fingerprint me. False positive banning humans with hardened browsers isn't legitimate. It's a sysadmin failing at their job

That is actually diabolical, but let me guess, AliExpress will face no repercussions at all

Wasn’t the AliExpress guy kidnapped by the CCCP a few years ago, and eventually released back into his former role? What was up with that?

Edit: https://www.bbc.com/news/technology-56448688