Inaudible sounds used to fingerprint browsers catch AliExpress red-handed
ars ·
AliExpress was caught fingerprinting visitors using an outdated technique that sends inaudible sounds to browsers. Researcher Matthew Callaghan discovered this accidentally when loading the AliExpress homepage interrupted audio on his Bluetooth headphones. He found obfuscated scripts that used the WebAudio API to generate and analyze sound waveforms, with the volume set to zero so users hear nothing. This fingerprinting method worked in the past by exploiting differences in math libraries across systems, but it has largely been neutralized in modern browsers. Firefox fixed the issue in version 118 by using its own constant math libraries, and Chrome and Safari are also considered safe. AliExpress appears to be using more than a dozen other fingerprinting techniques, so this audio trick may be a leftover from earlier years. The incident highlights the ongoing race between browser makers and sites that seek to track users despite privacy protections.
ars