AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
blog.laserphile.comI wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days.
Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content...
Now I wonder, does this also allow websites to continue running in the background on mobile browsers? Playing media is one of the very few things that can convince iOS Safari to keep a tab running indefinitely, in my experience.
Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.
Are you running PiHole, Adguard or similar and using macOS? On macOS, Chrome treats 0.0.0.0 as a local address which results in these prompts. Switching to having blocked domains return NXDOMAIN can work around the issue.
Any chance it was a macOS prompt? Chrome needs local network permissions for WebRTC, Cast etc. even without any website accessing your local network.
Chrome says "this site", no? Isn't it the tab you have in focus?
I wonder what kind of person says 'Yes' to this prompt. It gives me the heebie jeebies.
pretty sure it is a way of fingerprinting your machine/network
Let's hope it's as simple as that and not a malvertising campaign.
Yeah, that’s always an automatic nope. No explanation of who/what is really asking or why so, no: your shit software or website can’t go snooping around on whatever network I happen to be on, whether that’s at home or at work.
I had this and it turned out to be my unifi firewall block triggering a false-positive in the browser.
ebay does this i think, someone else linked a post about port scanning
Something in my work's SSO / auth mechanism does this and if you click No it silently screws up the internal website you're visiting. It doesn't block you from logging in, just parts of the site don't load/work. I haven't been able to get a good answer on what the heck is going on but it's extremely annoying.
I wonder if it is something firefox and chrome devs need to look at because if it is accessing the audio device surely it should be notified to the user.
As I mentioned, I suspect that this is an active choice, as just displaying the icon whenever a media context exists seems much easier than inspecting the audio stream for non-zero volume media.
I can only assume that there are legitimate reasons for this as well, e.g. websites preparing/maintaining audio context for lower latency when they intermittently play audio etc.
Someone else mentioned that cloudflare uses the webaudio for verification challenge, but only triggers it briefly.
Ugh... Seems like we need an audio API web permission, or maybe do something like browser already do for some of the other APIs and actually require API users to actually play something or display a warning/play an annoying chime otherwise.
Not just notified but blocked by default. We already have similar bocks on autoplaying video (no audio until you interact) and access to microphones and cameras ("allow access.." popups).
Every time an article like this comes out, people wonder about aliexpress instead of why their browser allows this in the first place.
It does on my Firefox, I had to close their tab because it also tricks kde into thinking I'm playing audio.
Thaaaaaaat explains why an open Aliexpress tab always bumps my thermals ever so slightly.
It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period.
Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.
I do not have the Zoom app in any form installed. I'd much rather use it in the browser. When I close the tab, Zoom is gone. After the COVID era bullshit of Zoom installing a utility that gives root access to anything, I've never installed it. Luckily, all of that came out before I started using Zoom.
There's a solution to both:
1. Not make web browser general-purpose runtimes for arbitrary software.
2. OS builds a general-purposes runtime that's completely sandboxed. So users can run more complex software without needing to worry about cruft being installed on their system.
Unfortunately, browser builders have decided that web browsers are #2.
This issue is about audio output. Audio and video input are both behind per-site permissions.
Also, people can and should go to the firefox settings > Permissions and data > Autoplay and change the Default for all websites to "Block Audio" (at least).
You can set per-hostname exceptions if you like! CTRL + I > Permissions
> You can set per-hostname exceptions if you like! CTRL + I > Permissions
1. Thank you, that's very nice to know about.
2. I really wish this was exposed more directly, probably from the permissions button that is already in the address bar. I can't believe Chrome does this better.
Unfortunately that still gives another data point for fingerprinting.
It should instead trigger a little germ icon, like a virus, because it's like a virus.
The speaker icon would be handy but I think that it depends from both the good will of Firefox and the installed add ons. Of course if an add on blocks the audio file there is no need to display the speaker icon for that file.
To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my Android phone. It shows a number of sites. Nothing in first party and these that I must fully enable to make the site work (css, image, script, xhr)
* aliexpress.com
* ase.aliexpress.com
* it.aliexpress.com (my country two letters domain)
* umdc-global.aliexpress.com
* aidcgroup.net
* ase.aidcgroup.net
* 67372.ase.aidcgroup.net
* alibaba-inc.com
* epss.alibaba-inc.com
* alicdn.com
* ae01.alicdn.com
* assets.alicdn.com
* aliexpress-media.com
* ae-pic-a1.aliexpress-media.com
* assets.aliexpress-media.com
* aliyun.com
* acjs.aliyun.com
Scary list, right? According to google aidcroup is
> Alibaba International IPP Platform
> Alibaba International is committed to the protection of intellectual property rights. Right holders and their agents can enforce intellectual property ...
Let me add a /s to the last line
There are two more sites that I can completely block
* googlesyndication.com
* pagead2.googlesyndication.com
so even Alibaba runs ads on Google.
I did not instrument the browser like the author of the post did, so I don't know where the audio comes from. There is nothing listed in the media column of uMatrix. This does not mean that the post is inaccurate. It could be that the browser gets the audio stream from a request in one of the other categories.
uBlockOrigin blocks two of other requests.
1. https://g.alicdn.com/code/npm/@ali/gmod-pop-disclosure-code/...
and this one that I anonymize
2. https://aplus.aliexpress.com/g.gif?logtype=0&title=WebPush Permission&pre=https://it.aliexpress.com/?gatewayAdapt=glo2ita&scr=1920x1080&_p_url=https://it.aliexpress.com/wp.html&cna=<whatever cna is>&category=&aplus=&$${beacon_mini}$$=&yunid=&=&trid=<trid>&asid=<base64 stuff>$${get_sign}$$&p=1&o=linux&b=firefox153&s=1920x1080&w=gecko&ism=other&cache=<7 letters>&lver=8.15.25&jsver=aplus_std&pver=0.7.12&_pw=0&_ph=0&tag=1&stag=-1&lstag=-1&_slog=0
Probably the audio file is coming from one of the unblocked requests but my Debian laptop does not pair with my Bluetooth earpieces so I can't test it.
It doesn't actually stream an audio file, the scripts generate audio at runtime using a sawtooth oscillator. It also only happens after several seconds.
Thanks. So one of the downloaded scripts is generating the audio and the browser should detect it.
I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue.
@FireFoxDudes You need to be addressing fingerprinting
Or just started removing features and debloating the Web standards. We don't need WebCoffeeBeansRoasterGrinder or WebElectricVehicleEmergencyBraking. We should be able to live with a LOT less without graphics, performance, or addictiveness degradation.
How? How would a browser "know" what classifies as finger printing? Literally every piece of the engine is used for finger printing.
It can be mitigated, a bit, but I don't see how browsers can win that battle.
Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).
I feel like there are two levels of fingerprinting here, and a lot of the confusion is downstream of not properly distinguishing them:
There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc.
I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.
I've only encountered the latter described as fingerprinting. Which makes sense side, like fingerprints, the information is being used to uniquely identify an individual.
The former is traditional analytics and is not enough to uniquely identify an individual.
Not all analytics are as privacy invasive as fingerprinting.
>The former is traditional analytics and is not enough to uniquely identify an individual
shockingly little information is required to uniquely identify someone.
"traditional analytics" (lets just say os + browser + some hardware info) is likely to be uniquely identifying when combined with just one other sparse dataset.
>Not all analytics are as privacy invasive as fingerprinting.
fingerprinting isn't a separate category of analytics. every data point can be (and often is) used for fingerprinting.
Just assume any site using javascript is using it for nefarious purposes.
a lot of what is used for fingerprinting is also used legitimately, and a lot of sites fingerprint. so ~every site would be behind a security risk warning.
we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored
Presumably the intended outcome would be that sites would be pressured into not being malignant actors with regards to user privacy, rather than everyone just ignoring the security notice.
i understand the intention, and i offered my opinion on what the actual outcome would be.
~every piece of data can be used for fingerprinting. settings and preferences, browser, os, etc. fingerprinting is not its own category of data, it's the correlation of regular data.
the "pressure" ends up being: stop receiving any data at all (which would obviously break ~everything), or put up a warning (leading to fatigue).
consider accessibility settings: absolutely required for some people to browse the internet, but also extremely high-value data for fingerprinting a user.
there is no technical method to know whether someone asking about a visitor's accessibility settings is doing it so that they can properly display content or so that they can fingerprint the visitor.
With my previous hearing aid I noticed that visiting a wide variety of web sites would cause a change in the amplification of environmental noise. I always assumed it was doing something with Bluetooth, and probably not for a good reason. This is with an iPhone 13 and one Kirkland/phonak hearing aid.
I haven’t noticed this recently, but I also now have two newer Phonak hearing aids and a few iOS updates have happened. Maybe the silent Bluetooth shenanigans are less disruptive to my new aids or the programming is different. Surely shenanigans continue.
It's the Bluetooth; when Bluetooth connects most hearing aids reduce the environmental volume slightly so you can hear the streaming content. Some app has started to play audio (perhaps silently). I notice it on some websites.
How much HAs reduce environmental sounds when streaming is configurable by the way, but only by the audiologist if you don't have your own programmer. I don't like the effect and prefer to just turn down the volume manually.
Is this tunable per hearing program? When in an even moderately noisy environment I find myself switching to AirPods if I’m streaming. I would love for the HA to give separate controls for BT audio vs ambient like AirPods do.
I wear Phonak CI processors. It's not just you. I've also experienced the volume drop on a few sites and apps. The Amazon iOS app does this. Each time I leave the app, ambient audio returns to normal.
They’re kindly turning down the background noise so you can focus on shopping and buying more stuff.
It'd be interesting to see what a lawyer specializing in disability law would think of that.
At least in the US, I could see that being something that the ADA prohibits.
I noticed my MBP had a periodic stutter sometimes: every 3 seconds or so the mouse would lock up for a few milliseconds.
I tracked it down to American Express's login page (auto loads if you leave the site idle) relying on Akamai's anti bot measures polling some web Bluetooth feature, causing Chrome to trigger a BT scan: https://castle.io/research/fingerprint-harvesting-in-the-bot...
Turning off Bluetooth solves it, but that's not a great solution when using a Bluetooth mouse... and it sounds like it might be causing your issue too.
It seems far more likely that your cheap hearing aids are sensitive to certain RF frequencies and the background javascript is causing different patterns of load on the phone's CPU.
I would suspect that this only happens when you're charging and it is likely the charger or cable not being properly shielded.
The cheap hearing aid cost $750 for one and is substantially the same as the same thing sold from standalone audiologists for much more. These are not cheap over the counter devices.
Charging only happens while in the cradle, not while worn.
Audio is being generated and the BT device is prioritizing it by changing its internal mixer settings. Same as audio prompts over music in a car. This could be mitigated by detecting silence in the audio stream but this is anti-consumer behavior that needlessly drains batteries with excess transceiver activity.
> cheap hearing aids
I don't think you know what you are talking about
I noticed in the last few weeks that if I’d recently opened the AliExpress iOS app (ie. it was backgrounded) my car audio would freak out thinking I was giving it an audio command. Killing the AliExpress app immediately fixed the problem. After seeing it happen more than once I assumed it was something dodgey and uninstalled the app.
I cannot ever imagine installing something like AliExpress as an app.
Not sure if they still do, but a couple years ago prices in the app were lower than on the website. And they promoted installing it to save money.
I believe the prices are the same. But the app has a number of "games" to collect tokens that get credited as discounts. Seems to be mostly stuff designed to get you to open the app daily and browse their offers. Which might be "innocent" if it's just to get you to buy more stuff, or maybe they have more reasons they want you to have the app open. Who knows
At least Aliexpress doesn't have all the fake slot machine type games that temu has that always end in variations of "get $200 of discounts for your next order if you order x items from this list"
There are few things more scammy than AliExpress “discounts”. I have yet to see a cent of the hundreds of dollars of “savings” they gave or advertised to me.
They used to give 5-10 bucks of credit to new users a few years ago. Real credits, I very carefully compared prices from different IPs.
So I would register a new account for each order -- 10 USD is quite a lot of money in my country -- and saved at least a hundred on buying dev boards and other components.
Very true, I almost never use Ali Express because I have no clue what anything is going to cost until I get to roughly the final step of checking out.
That's how you know you absolutely should not do that.
Like a white van with FREE CANDY written on it...
It worked for Reddit... It used to be a 100% website experience and now I'd venture the majority of their traffic is from the mobile app.
Now we know why...
And someone would install random apps to save $5 on $100 purchases?
Sure. I can live for a day on those five bucks. You wouldn't believe what people in low income countries go through to save a bit of money: I've seen people I know (but couldn't stop in time) send copies of their ID to some shady company to get a five percent discount on gasoline.
"random apps" and it's the largest eCommerce company on the planet
So what? I install 0 ecommerce mobile apps.
What, I suddenly need to buy Alibaba crap and I can't wait to get to a laptop browser?
When I did customer tech support for a major retailer, we had confused customers calling all the time because they would randomly get price-match refunds they never asked for. They were installing apps that were automatically requesting the refunds by searching their emails for orders and checking the prices on the websites. These people had no idea they had even given these apps permission to read their emails.
You'd be surprised on what general public can go to save $5.
I mean, I'm haunted by the things I did for a Klondike Bar.
eBay keeps pushing their app with a $5 discount, advertised using a focus-stealing popup interrupting your attempt to give them money, so some people must be taking the bait.
They also don't give you a proper tracking number. The only way to track your shipment is in the app.
This is not correct. I do not have the app and get tracking for my orders.
I get email updates but whenever I click the track link it tells me I need the app.
I have a package on the way with AliExpress. It is headed from somewhere in China to somewhere in the US.
Using my computer just now, I looked at one of the emails that AliExpress sent about this order. It had a clickable tracking number displayed; I clicked it.
That brought me to their website, where I landed on a page that included the last update for my order and also a link to "View Details".
That works for me. It was very easy to where along the line my stuff is (and that it is not in the US yet).
---
Meanwhile: I also copied the tracking number from the email. I pasted that tracking number into the box at usps.com.
The USPS knows of my tracking number and they do not have my item yet. Fair enough.
I ticked some boxes and told them to send me updates, which I'm sure they'll do once they have updates to send -- just as they have done for ~decades now.
This also works for me.
Many sites will work fine in a desktop browser but refuse to do anything in a mobile browser, demanding you install their app or just immediately redirecting you to the iOS or Android app store.
It does show a popup to that effect, but if you dismiss it you can still see the tracking info. Definitely annoying, but not unworkable.
If on mobile, ticking "desktop mode" in your browser usually goes around that dark pattern.
Depends on the shipping company, and likely on your location. I get tracking numbers for most but not all shipments
You just have to press the right link on the site and you get the tracking page (despite saying you need the app).
It's still the case that you pay less in the app. You get 'coins' for a daily check-in, which are automatically(?) applied as a discount. Most items either don't actually use them or only give you a pointless 1% off or something, but I've gotten a $12 microcontroller for $5, for example. I think some coupons are app-only, too (though most aliexpress sales are fake and are better thought of as the normal price).
You pay less money in the app.
Companies are not going to hire a mobile dev team to create an app to give you a way to pay them less for a good.
They hire a mobile dev team to create an app to give you a way to hand over data that you otherwise wouldn't, is technically impossible to do through a web browser, and is worth more than the discount that they give you for using the app.
>You get 'coins' for a daily check-in, which are automatically(?) applied as a discount.
This should be illegal
> Not sure if they still do, but a couple years ago prices in app were lower than on the website. And they promoted installing it to save money.
Translation: They are able to mine your personal data more completely with an app installed vs the website which they can sell for pure profit. They promoted installing it to extract more value from you.
That's definitely a feasible explanation (and the one I would assume to be true for AliExpress).
But there is another, slightly less evil, explanation that I know at least some companies have pushed their apps because of: the thinking is that if you're on their website, there is less friction to open a new tab and search for a lower price from their competitors, than if you're in their app. Obviously it's hardly any different - opening a new app (the web browser) vs. opening a new tab in the app you're already in - but the theory is that there's a slight psychological difference.
Of course I'm not saying that trying to prevent your customers from searching for better deals is a nice thing to do. Just adding that data mining isn't the only reason for some companies to want people to use their apps.
It's quickly getting to the point for me that "find the thing I want locally and buy online if it's cheaper" is reversing. I've actually been to one of the few remaining electronics retailers to look for a PC for my kid recently, and it was nice not to be assailed by dark patterns (yes, there are dark patterns in b&m retail, but they're much more obvious).
It also all goes to the party, who are the owners of Alibaba (and every other company in China).
Should you ever need someone in a foreign country to do something for you, it's good to have as much information as possible at your disposal about them.
Absolutely crazy the amount of dodgy apps people install and giving permissions to read the system when asked...
Yesterday on here, somebody was demo'ing a sun clock website that asks for your position.......
....and yes, many HN'ers were clearly happy to give there precise GNSS coordinates to some random scrote who askes for them.
A lot of people install TikTok. Or Instagram.
Or Claude/etc on their personal computers and then even live dangerously.
It's great for shopping. But in the US you have amazon prime. We don't.
I have Prime, but I can't imagine installing the Amazon app either. The website works just fine.
This is the way. It's prudent to treat apps with skepticism, it's unfortunate it's come to this.
I study Apple's Privacy Nutrition Labels religiously every time I consider installing an app.
I like the ones with "Data Not Collected".
I'm an app developer and all my apps have the "Data Not Collected" privacy nutrition label. I love the idea, but Apple's enforcement of it is very lackadaisical. I've reported dozens of apps that were blatantly lying on their privacy nutrition labels to Apple and I'm yet to see any such app's nutrition label change.
Here's a good overview of the problem: https://arxiv.org/abs/2206.02658v3
Why have rules (or laws) if they don’t enforce them? Or only enforce them selectively when they feel it necessary, such as when not doing so would threaten your stock price (or re-election campaign)? Maybe I just answered my own question?
Reminds me of meat processing regulations. I can sell my animals whole to buyers through a custom processing exemption, but they must go pick up their meat from the butcher. The law says I cannot pick up and deliver it, but it is trivial to find people advertising that extra service. Reporting them does not result in any obvious action.
In both of our cases, our honesty is a liability in the marketplace, because people are ignorant of such laws (or simply don’t care). Really, they simply want the product that they want, as conveniently as possible. We are then forced to compete in the marketplace with liars and cheats.
I am sure our peers here can find countless examples in other areas where this flavor of dishonesty prevails. Hell, I would love to hear some counter examples, because I cannot help but view this state of affairs as intentional at this point.
The purpose of system is what it does (or, in this case, does not do).
The cynical way to look at this is that the purpose of the system (the privacy nutrition label) is to support Apple's carefully-crafted and -marketed image as the most privacy-focused of the tech giants. Actually having enforcement of the contents of said labels would be a nice potential byproduct of that, but that's not strictly required to accomplish the system's purpose.
I uninstalled the app recently; despite having layers of ad tracking protection, I would see my Amazon searches appearing in my social media feed in near real time, and this irked me.
I dropped their .com into a Home Screen icon, and this completely stopped (at least as far as I’ve observed). It’s definitely more janky from an experience perspective, but still easier than driving to the store.
Shopping works better on web sites because can open multiple tabs to browse multiple products. Especially important on big stores like Aliexpress and Amazon where need to compare lots of products. Desktop is better for that but mobile browsers are still better than apps.
With Firefox, yes. I wouldn't fully trust other browsers to care about my privacy.
Using web apps on Firefox really is the way given its support for uBlock Origin.
Screen real estate is precious on phones, so being able to permanently block "Install our app!" and even entire navigation categories (shorts on LinkedIn) is quite valuable.
Then you can "install" the site on your home screen or simply place it in collection folders so it's sitting ready on your "New Tab" page.
I think you need the app to use the delivery lockers (which I prefer over home delivery)
AFAIK, the app is just the website in a webview.
I don't have Amazon Prime (nor am I in the US) yet use Aliexpress perfectly fine on my mobile phone without using an app. Frankly, I don't understand how the two is related at all?
AliExpress won't allow me to open most pages in the account section on my iPhone. Instead I get a page telling me to install the app.
While browsing, there are also popups offering the app approximately every third link I click. Some of them are telling me to install the app.
Unless the situation has changed recently, it's not perfectly fine, it is unusable on purpose.
AE website on mobile is terrible, they basically force you to use the app. I exclusively use the website on my PC
So they're pulling a Reddit, basically.
"The app is great because the website is heavily degraded".
Reddit is fine, just a small popup at the bottom. Facebook kn the other hand turned off most functions on mobile, e.g. chat. Good thing though if you don't use the chat long enough, friends start using other means of communication.
Reddit is NOT FINE. They throw up full page modals now telling you to continue in the app.
Soon we'll realize that the experience of using reddit (and other mainstream social media) differs a lot based on what country you're in, and sometimes even the state.
For example, seemingly a bunch of places in Europe/elsewhere has disabled old.reddit.com unless you're logged in, but seemingly a bunch of people in other places can use it just fine. I'm sure what both of you are seeing is both correct, there is just something changing the experience that gets served to each of you.
First time I've ever seen it. No clear way to bypass it either.Log in to use old Reddit To keep Reddit safe, accounts are required to access old Reddit. Log in, or continue without an account on reddit.com.
I just request the desktop site, it's fine
Both are web stores. Both have websites AND apps.
They are compared / contrasted. Nobody is saying one is concretely related to the other.
Where is "we"?
Likely the place where people are "willing to trade privacy for convenience", according to Baidu's CEO.
I always wonder if it's worth it. Like: is it actually convenient, or is it 'solving' inconveniences which actually do not exist or didn't exist before using the service? I have never used Prime or AliExpress but also don't consider our typical shopping very inconvenient. And the most inconvenient parts are actually the ones which seem necessary to to get the proper goods (from past weeks: vegetables/fruits/shoes - it's not really possible to order that online and get exactly what we want). And everything else is available from other webshops.
According to their profile: Norway
But isn’t the promise of the app store that the apps are checked for malicious code and more control of the permissions compared to a browser website?
You probably buy things off amazon that are dropshipped from AliExpress all the time. Stop with the elitism
This is not about the products that are shipped, but the app itself. I would caution people to never install it as well.
I buy directly from AliExpress all the time. I wouldn't install their app.
On AliExpress I see things like 64 TB (no, not GB!) USB flash drives for less than 10 euro, obviously a scam. I also see less spectacular products but still good looking deals, but without a brand name so you can't search the web for reviews.
On Amazon I never see products like that. That's why I prefer Amazon (and Coolblue and bol.com in Belgium).
I see this kind of fakes on eBay or Amazon all the time. It's even harder to report it than on AliExpress and I never had an obvious report of fakes upheld (AND eBay warns they will forward your identity to the seller. Great thing if the organised crime is involved in this)
Case in point, fake 2TB Sandisk ExtremePro microSD:
- £17 on eBay: https://www.ebay.co.uk/itm/336728033240 - even the images prove it's a fake (also $570 on sandisk.com)
Agreed, there's more of that on AliExpress but Amazon is not free from that either.
Few years back, Amazon had a rampant "fake USB storage" problem too. Then, one day, all the fakes were gone, just like that.
If you believe that, I have some USB storage to sell you. Huge capacity, barely used. I keep my inventory in storage under this bridge, which I also happen to have for sale. Interested? ;)
I can't imagine ever wanting to install an amazon app either. Both of these stores have perfectly functional websites. What would I gain installing their spyware? Also, why so defensive?
In first world countries, buying from a local reseller grants you customer rights (like returning or replacing defective items).
Not if the local reseller simply calls itself a marketplace and logistics company and the local regulator lets them get away with it.
Amazon, in my experience, does arbitrate disputes about returns and defects, but the important point is that from a legal perspective, I don't think they have to, so you're at their mercy.
You can't even be sure that VAT is handled correctly, which local retailers can usually not get around.
I cannot imagine installing amazon as an App as well. It's a website
Having bought many things off AliExpress over the years I can say with complete confidence that I've never made a purchase on Amazon that was dropshipped from Ali. The shipping times are far different and it would be immediately obvious.
Yeah it would be hard to hide. When I order from AliExpress it arrives via Chinese carriers I have never even hard of, and about half the time the final delivery is through a Chinese gig delivery company that must pay practically nothing to the driver because they will usually drive up in front of my house and chuck the package out the window onto my front lawn.
I've ordered things from AliExpress shipped from the local warehouses (2-3 days delivery) ; I've ordered things on Amazon UK that were fulfilled and shipped from Amazon UK that were delivered in 3-5 working days.
Not a £1 tat, and not one off. Not that AliExpress is my choice, no, far from it. Sometimes it's better, closer to the manufacturer, that's all.
Love Temu and AliExpress for specialized components at dirt cheap prices. I would never, ever install their app. Ever, security nightmare.
Similar to how I use Amazon Prime but would never order something I ingest, put on my skin, or (usually) wear from it.
Not elitest.
And that's OK with Apple's App review?
They let all sorts of stuff that they shouldn't in.
For instance, Meta and Google publish 'free' iOS libraries that firehose surveillance data back to them. The libraries are popular, so apps that use them must be allowed into the store despite taking them as dependencies.
If you can get access to .ipa files (I think you'd need to jailbreak -- apparently this stuff is encrypted by Apple) or packet sniffer, then you can get an idea of how bad it is for the apps you use.
This tool claims to do the sort of analysis I'm talking about (among other things), but I've never tried:
I'm wondering if the reviewers neglected to review the app while driving a car and listening to audio.
It's known that some Chinese mobile apps employ this trick to keep the app alive in the background, the rumor is that this way the 'active user' KPI can be better met.
edit: quantity qualifier
Why would they manipulate the numbers that way if it’s self-reported anyways? If you want to fake the numbers, couldn’t you just change the number and be done?
The people fudging the metric (developers) may not be the same people that are relying on the metrics (managers). Perverse incentives at play could easily motivate this kind of shenanigan.
It's probably quite difficult to manipulate per-user metrics after the data is collected.
If it's known, are you suggesting that Apple and Google are complacent in allowing these type of apps in their ecosystem?
I wouldn't think of giant organizations like Apple and Google as mere individuals that can exercise human emotions such as complacency.
WebAudio fingerprinting is largely mitigated (in Firefox, potentially other browsers) - I wrote a quick overview that talks about the current distribution of values as well as our more recent efforts. https://ritter.vg/blog-webaudio_alibaba.html
So Apple will remove them from the App Store. Thats their whole argument for their closed system - they’ll protect users from malicious apps. Right?
it's not the app that it's malicious, it's the website
It's both, according to another comment.
i'd argue that perhaps the ability to play audio should be permission gated, much like the ability to use webcam/microphone.
However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to.
With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing this, I'll be more willing to be bothered every time I want to play a video with audio to approve it if this bothers me.
I would actually love if I could have iOS prompt me to allow certain apps to use the speakers. I hate using an app and suddenly have a video autoplay loudly.
I wish Android had this as well. There are apps where it's difficult-to-impossible to turn all sound off, and I wish I could just tell my phone that this app is just never allowed to use the speakers.
On Samsung Android phones there is a Samsung app that isn't installed by default that allows to individually manage volume/mute per app called SoundAssistant (and few more neat customizations for audio/audio controls).
I don't think many people know about it, it's made by Good Lock Labs which is basically a group of Samsung devs making advanced customization apps: https://galaxystore.samsung.com/detail/com.samsung.android.s...
You access the features from the OS volume control once installed, there's a "..." button.
Always wondered if that also works on non-Samsung phones, but it's quite useful to forever mute an app.
Inside iOS accessibility settings you can turn off “auto-play video previews.” This blocks perhaps 20% of video autoplay; it’s still better than nothing.
Philosophically I hate silent video autoplays just as much as I hate autoplays with audio. One distracts your visual attention, the other distracts your aural attention, and I don’t quite understand why society has normalized silent video autoplay.
This. This needs to be a thing.
To be fair, it shouldn't need to be a thing.
(One should really not tolerate such dodgy software).
The ability to play audio can usually be permission gated with tab muting, however the methods aliexpress use bypass that mechanism completely.
This is the part you should be highlighting aggressively. That’s very uncomfortable
Firefox allows to Block "Audio and Video" (or "Only Audio") from auto playing per domain, including on Mobile.
Ah, so that's what Wolt (Doordash but in Europe) is doing.
I noticed that Voice Over (iOS screen reader) crackles and randomly changes volume when using the app, but I attributed it to standard iOS weirdness, and possibly misuse of some iOS API. Now I'm thinking that this may very well be fingerprinting.
This is actually a really common form of fingerprinting. At one point in time, it could generally tell the website what operating system and CPU architecture you're running on. I know this type of fingerprinting was fixed in Chrome so it always gives the same answers regardless of platform. I think it was also fixed in Firefox and Safari, but I don't follow their releases as closely.
Of course, even though it's probably useless now, things like that hang around because it costs more for trackers to remove the code than it does to keep it in.
> screen and viewport dimensions
I remember trying I think it was the Tor browser, being puzzled at why the viewable area of the window constantly changed when resized but would never occupy the full window.
I feel a little silly now.
Recently I ran into a problem with my Bluetooth headphones. They support multipoint bluetooth audio, so they can be connected to my PC and phone at the same time. Opening the Aliexpress webpage causes a silent audio stream keeping the PC>headphone link active blocking my phone audio. An investigation reveals obfuscated code running device fingerprinting with a side effect being a silent audio stream that firefox, chrome and windows does not recognise but which kept the bluetooth connection active.
Is this an AI summary of the article?
No, I took the first sentence of my article and then edited the rest of the intro + conclusion to keep it short for HN.
You should make that obvious in some way like using “TLDR”. I assume many people, like me, would attempt to parse your comment as a comment on the article, after all it’s in the comment section, and read that way it’s very confusing lol.
Sorry, this is my first post to HN and in the submission it looked like the description text i added would be part of the post header.
Don’t apologize. This was a very fascinating read, and a good technical write up, especially for you first even HN post. It’s not your fault others didn’t look at the username :)
Thanks for the feedback :D
I was just about to highlight this particular HN quirk. I suppose a lot of people here only ever comment (or submit URLs without any text of their own) and aren't familiar with it.
HN's fault entirely. The post form's actioning "text" as a comment is remiss.
They shouldn’t have to make it “obvious”. They are the actual author of the article. It’s not their fault you didn’t double check the usernames. It’s not uncommon for authors to comment on their own articles.
No you are talking to the actual author of the article. It’s not weird for the author to comment on their own article
Concerning situation, I think. And I suspect (perhaps wrongly) that there are even more reasons for concern with technology that can track, capture, leak etc. information that's more sensitive or valuable, depending on how one wishes to look at it. Mobile phones, computers, routers etc. -- all have the potential to siphon out valuable information to a bad actor, especially when it comes to espionage, military, commercial etc. This has already happened at a significant scael, so it's not a remote scenario.
At the very least, governments and institutions should develop a framework to investigate all acquired technology. The community / civil society could also create something similar, a script that would analyse at a deep level everything that can be analysed with a piece of software even by a complete novice.
Yes, I find it concerning too. I particularly dislike that windows was not aware, nor could it stop the audio stream from effecting the hardware. What other side channels like that exist? Perhaps I can be blamed for using windows
> Perhaps I can be blamed for using windows
That would be unreasonable, I argue. No one should have to worry about the security of their devices and data privacy based on which OS they use. Whilst it can be argued that different OSs serve different needs, privacy and security should not be debatable. In fact, most countries have dedicated legislation for this; whether it's just, applied correctly, or serves the public before any other party are indeed discussions to be had.
I am pretty sure my phone is listening. The ads I see this week are about topics I discussed last week. Week for week. Stupid thing is that I need the phone to have near by as self-employed electrician. Clients want to communicate after regular office hours. Since the phone is rigged why computer shouldn’t?
We take everything we have, freedom, privacy, free speech, for granted. The reality seems to be that these concepts are fungible and that we have to be ready to fight for them. Instead we trade these for convenience, and it's very very sad.
Getting the same issue when opening Stripe Dashboard with AirPod on.
A part of me is always smiling a little inside when people find creative ways to abuse browsers. It's always one more demonstration that the current web is fundamentally broken by design. The distinction between web browsers and random programs that allow remore arbitrary code execution is becoming more and more academic with every new feature that gets exposed to JavaScript.
Of course, I am also a horrible hypocrite and will actually use websites that use features like WebUSB or WebRTC.
It was a mistake to normalize blindly executing whatever code the server sends your browser. One day we'll look back on this era and wish we had pulled the plug sooner.
Need to rethink the system that allows for (and encourages) this kind of plausible deniability. From "Oh we need this permission for [non essential feature] and you need to accept it if you want the app at all" -> to giving the user ultimate control over what happens on their personal device. Virtualize what the app can see and use fake data/identifiers/devices if necessary to get it to do what its supposed to. If the App isn't going to act in good faith why should the user? Fine grained permissions don't really work in practice because the app can keep annoying the user until they give in and hit Allow.
Also perhaps AI agents are now capable enough to run these apps the way the user would and recognize these dark patterns. Flag those and feed it back to a warning at the point of sale that users can upvote there to signal their disapproval and a threshold score that risks removal of the app from the store. Because bad behaviour continues to make business sense if the rules allow it. Moreover, it penalizes and puts pressure on the good actors as a "missed business opportunity".
Maybe just have Claude rebuild the app in a non-scummy way. Analyze the site for the relevant data APIs, while avoiding the tracking stuff. Maybe someone maintains an MCP for these popular websites so people can use agents on them.
What you want is basically how it works. On both phone platforms and PWAs, all permissions are visible to the user explicitly. All of them can be revoked at any time. Apps are disallowed from requesting an already-denied permission.
Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party software isn't under any obligation to work without them.
But the platforms have done what the platforms can do, at the architecture side, really. The next stage is human-audited enforcement of malware, which this AliExpress nonsense might hopefully run afoul of.
> Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working),
How can they tell? For the permissions I can think of: location, filesystem, etc. it should be easy to lie/spoof.
>Obviously apps can tell if they haven't been granted a permission
By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission.
In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.
Soundd like a nightmare to build legitimate apps if you for example are building an app that uses the camera but you can’t in anyway tell that using the camera fails (because user had denied the permission 6 months ago and has no memory of it) and instead of being able to give a helpful error you are just ending up with I am guessing fake images (maybe just a black screen).
Just because it's hard doesn't mean you shouldn't try. What about a popup saying "xyz has tried to access the camera a lot lately, continue blocking?"? Or apps can apply for set of 'core permissions' that can't be denied but are much more tightly controlled? Apple and Google are some of the biggest companies in the world, they don't deserve as much leeway as you're offering.
The image could contain a message that it is disabled.
So we must also make it impossible for an app to read any images taken inside the app itself? You can’t literally make any apps at all
Then it is detectable. Those permissions should have a third option alongside allow and block - spoof.
That does nothing but start an arms race. Fine, audio "works" but do you get noise? Can you read back the sounds you play? No, right? It doesn't work, QED. Now the platform needs to fake the noise.
Likewise for any other hardware access you want, and most of them are harder. How do you fake local storage without storing anything? How do you fake Bluetooth access without virtualizing an entire device? Do you fake the screen dimensions to look like something else? Input latency? Where does it stop?
No, "does this work" is among the easiest questions to answer in technology. We aren't going to win this war.
> Can you read back the sounds you play?
No, but you also can’t do that if the user approves your app’s permission to play audio, but has the volume permanently turned down to zero.
> local storage
Give the app a temporary, space-constrained store that isn’t shared with other apps.
> bluetooth
Don’t let apps access raw bluetooth signals, but instead ask the platform to display a pairing interface (possibly with a custom stylesheet), ask the platform to call you back when a specific device is in range, etc.
> screen dimensions
Not personal data.
> input latency
Fudge the numbers even when the user grants permission.
This isn’t a war, it’s just engineering for the benefit and autonomy of the user, and not the platforms’ commercial interests.
> This isn’t a war
Fingerprinting and other quasi-malware techniques being used by desirable third party software are absolutely a war, otherwise we wouldn't have this permission structure in place in the first place. And as much as you believe the contrary, Alibaba et. al. are 100% smarter than you about how to exploit these tricks and will win.
> Not personal data.
LOL
The best you can do on the modern web is reduce your fingerprint footprint, though it comes at a cost of websites breaking from JS disabling, or local time zone anonymisation.
Browser fingerprinting can get creative at times, to say the least. eBay's WebSocket port scanner [1] and Reddit's abuse of DRM and JavaScript JIT exploits [2] from years ago are two examples of the kind of in-depth introspection you can perform completely in the background using nothing more than simple non-permission-gated APIs.
Thanks for the reads
This article writing is really clean and enjoyable to read. And I learnt something.
Thank you very much.
aliexpress is largely a bait and switch site.
most of the prices change during checkout in the most frustrating ways. one u ready to check out, and provide ur payment into, and click to pay... they interrupt this fake checkout with a popover, inform u the price is actually much higher, and dangle a button which is one click to accept the new higher price.
this is total scam behaviour and probably illegal in most US states.
I did not have that experience at all, ordered there dozens of times.
I've seen this on many many other sites as well, most notably Twitter, and lots of common modern captcha pages too. Very annoying!
I’ve noticed this and on other apps too, it breaks AirPods and when background playing Spotify it’s very obvious.
Thanks for investigating! Makes sense it’s also in the taobao app on ios too.
I wonder if this is something the iOS Facebook app also does? It constantly pauses my Apple Music playing. Soooo irritating.
When I visit an article on a popular German tech news website, it interrupts music playback on my iPad (the website takes audio focus). I bet they do something similar.
Why are web pages allowed by default to do such things? Browsers should give the user the ability to forbid all sorts of thing and have them forbidden by default.
Somebody (Mozilla?) should make a browser that just proactively blocks shit like this
I’m sure some Adblock addon could do it but at the browser level would be preferred. A browser vendor that just proactively does security and “correctness” tweaks to live sites would actually be in my interests as a user
JS enabled by default seems every day less secure.
So many website break completely with JS disabled and you end up having to enable it half the time anyway.
About half of the time, when a website doesn't work with js disabled, I realize that I didn't want to see the page that badly anyway, and I close the tab.
It was pretty good until about six months ago. Since then loads of sites have added a js requirement to try to stop the AI bots.
IMO web browser have been enabling all sorts of obnoxious behavior since before JS. One of my all time favorites were the sites that opened pop-ups in a loop faster than you could close them while an audio clip of a guy yelling "Hey everyone! I'm looking at gay porn!" You had to hit reset. Fuck the Web.
The web around the late 90s and early 2000s had some really sketchy stuff. I think the difference is that it used to be the sleazy underbelly. Now it's accepted as mainstream.
My local 'newspaper' website is chock full of scam adverts. The print version is dignified. The website people, somehow, turn a blind eye.
And I got an advert on Youtube this week using sexually explicit language to sell pills.
Feels like standards, and expectations, have really slipped.
Opening a popup needs JS though.
Not with the new popover API.
This doesn't look like it gives websites something they couldn't do before with CSS and JS.
I'm pretty sure it does but maybe I'm wrong, I had never tried to create popovers/popups using CSS. What's neat[†] about the popovers API is that it doesn't need any JS, you just write a couple of HTML attributes and voila, a popover/popup. They will run with JS disabled as well.
https://chrisburnell.com/html-can-do-that/
[†] Neat for me building things like tooltips and dropdowns into my web apps without using JS; not neat for annoying people with popups.
Aha this would explain. I have seen similar behaviour with a news website trying DRM requests (has no reason to ask this info) resulting in stopping playback.. did not consider the impact of multipoint here. Interesting, might be worth looking into if i see this "bug" again.
I had this (?) happen. I have a soundbar hooked up through spdif in my pc. It automatically switches sources, so I can play music through airplay and then have it play sounds from pc when I open youtube etc. So it switches from airplay music to pc even when nothing is playing on pc. This was happening on some websites and it is extremely annoying.
Is there any particular reason these kinds of APIs are not behind permission prompts?
I thought the App Store review guidelines explicitly prohibit hidden features and using public APIs outside their intended purpose. Is audio-based fingerprinting just not something review can realistically catch?
They probe all audio devices, including microphones, which probably temporarily switches Bluetooth devices into HPF mode due to how Bluetooth duplex audio works.
I'd argue it's "silent" though: aliexpress wakes up my audio card if nothing plays, which results in a very faint "pop" sound every time I open the tab.
It's been this way for ~3+ years at least.
It's the website.
The title of the article literally mentions "WebAudio", and the first paragraph states that the author is using a PC. The second paragraph mentions Chrome and Firefox.
Apple and the App Store have zero involvement here.
This is a huge stretch, but if this problem exists in not only the PC versions of Chrome/Firefox but also the Android/iOS versions, then theoretically the app store reviewers could flag the browsers for facilitating this behavior against app store guidelines. In practice, apps of such caliber as popular browsers might be a bit above such reviewers' pay grade, so to speak.
> This is a huge stretch
This is nonsense. Safari also supports Web Audio. Safari does not, however, support Microsoft Windows, which is why the article author didn't mention it.
Moreover, all web browsers on iOS have to use Apple WebKit, so Web Audio support is not actually the fault of the non-Apple browser vendors.
Just curious, why silent sound would allow fingerprinting? What are they sampling if it can't be heard?
The script generates a known waveform, it is passed through the browser's audio implementation and then the script analyses the result after. Based on your devices settings and hardware the output will be different, e.g. a PC with analog output might have 44KHz audio output bandwidth, but a bluetooth headset might have a lower, different audio bandwidth. That is a datapoint that can be used in device fingerprinting alongside screen and viewport dimensions, device pixel ratio, browser plugins, etc.
On the one hand, I wouldn't expect too many variations here (the vast majority of devices probably use 48 kHz and 24-bit output, a few use 44.1 kHz and/or 16-bit, etc.) but just like DPR and all the other properties with a very small set of popular values in practice, you only need a bit or two from each measurement to eventually have a high quality fingerprint.
I think x.com does this too - haven't been able to dig deeper.
I notice this all of the time on sites with ads. I use AirPods to listen to music on my phone at work. Opening websites on my Mac routinely steals the AirPod connection but plays nothing audible.
Are you not required to grant an explicit permission for it to access audio? If not that is highly disturbing.
This at least partially contributed to a sleep related Firefox bug on Windows:
This is not limited to Bluetooth in any way. In pavucontrol I can see Firefox outputting audio when on AliExpress even though nothing is playing. The uBlock filter fixed it.
> The uBlock filter fixed it.
what filter ?
From the article:
To block the scripts open the uBlock dashboard, select My filters, and add:
! AliExpress AWSC fingerprinting scripts ||assets.aliexpress-media.com/g/AWSC/uab/*/collina.js$script,domain=aliexpress.com ||assets.aliexpress-media.com/g/AWSC/fireyejs/*/fireyejs.js$script,domain=aliexpress.com
That could explain the multipoint problems I've had in the last weeks, where audio would get "stuck" to one of my devices even when (apparently) nothing is playing.
I've had these issues on and off as early as 10 years ago when I got my first multipoint headphones.
Trying to debug this as a normal user is basically hopeless, you would never think to suspect a shopping tab. Glad someone did the legwork.
It just annoyed me so much that it was interrupting my music!
Hell hath no fury like an inconvenienced power user.
Bluetooth is such a mess. You know what didn't have this problem? Cables.
Also, non-multipoint Bluetooth.
90% of this stuff should be illegal
They have been doing this for months.
No sound playing but the audio would change like the microphone was being activated. I checked permissions to make sure there was no mic access and figured that they were fingerprinting.
I had noticed it before but I was browsing AE a lot today and i got fed up with it. What browser and OS are you using?
It was happening when I was using Chrome on iPhone and Windows 11 with Chrome. I can't remember what was causing it since the headphones (Bose Quietcomfort SE) are synced with both devices. For the last couple of months I've been using Android and I haven't noticed it. The headphones seem to work better with Android. IOS is a bit weird with sharing them with my PC.
This is the reason I use adguard everywhere
I use ublock origin and by default it wasn't blocking, i had to make a custom filter to block the scripts in order for it to prevent the audio takeover. Maybe adguard does a better job? Someone else suggested just wholesale disabling of JS but it is the nuclear option.
Besides the privacy implications, they are also wasting our fucking batteries on this crap...
Can we just limit web APIs to cookies and the likes as before? I don’t like how JavaScript has access to so many devices on the host. It’s a security and privacy nightmare.
This sounds like a GDPR issue no? Couldn't they be taken to the EU!
Yes. In this case probably not fineeprinting is not allowed because not strictly necessary (cookie law) and therefore needs consent from user.
Going batshit with browser APIs is also a formidable GDPR defense. e.g. try browsing the privacy-related forms for Google (https://myaccount.google.com) on Firefox :D (entire browser freezes up every other second for me, because of some extremely important work Google needs to run on my CPU to let me scroll down on a static site containing roughly 30 words)
Sounds like we're gonna need browsers to pop an audio playback permission, as annoying as that seems. Abusive sites just can't help themselves.
OP please submit the filter to an upstream uBlock filter list.
Will do! edit - How do i do this? through github issues? https://github.com/uBlockOrigin/uAssets/issues
They said they aren't interested
You can also submit to the EasyPrivacy list or one of the AdGuard lists.
chimed in... thank you for the great documentation!
I am glad people like the write up and it is fostering a conversation! It is such a happenstance that i looked into this.
There is no legit reason to be doing this.
> distinguish normal shoppers from automated
Why? Are you afraid of robots making you rich?
We need to find a solution to browsers sniffing on people. This here refers to AliExpress, but which browsers are typically spying on people like that in the first place? That's the real primary problem.
Cloudflare challenges also use Web Audio, by the way.
Does it hold an audio stream open constantly or just briefly during the challenge? On AE it never stops
Just briefly during the challenge.
Are there any EU/GDPR laws against fingerprinting?
Yes. In this case probably not allowed because not strictly necessary (cookie law) and therefore needs consent from user.
Do we have any jurisprudence on fingerprinting?
It's not just BT audio. In windows PC, if aliexpress is opened in one tab in chrome, and switching to a tab with youtube opened, audio don't play in this tab if you start playing youtube.
If this wasn't such a serious issue I'd be inclined to make a joke about being surprised that AliExpress was capable of such a thing, but I guess the complete shitshow of a website is intentional.
I wouldn't be surprised if what I'm feeling is all a psychological thing where consumers associate jank with low prices so that's why sites like AliExpress and Temu look like a complete technical mess when in reality they're doing pretty advanced stuff like this.
Another reason why Lockdown mode on iOS is your friend.
Lockdown mode is great, but it breaks phone calls on your Apple Watch (found that out the hard way)
Somebody else mentioned here that they also do it on the iOS app and I don't see how Lockdown mode would change anything, it doesn't prevent to play audio.
Meanwhile ppl freak out over Anthropic using timezone and Unicode for the same purpose, without realizing Chinese are simply ruthless in abusing iOS or Android or Web. Pinduoduo, who owns Temu, is infamous for exploiting an Android 0day vulnerability for such purposes.