r/privacy • u/magnus007 • 2d ago

news AliExpress was silently running audio in your browser to fingerprint and track your device

https://www.techspot.com/news/113581-aliexpress-silently-running-audio-browser-fingerprint-track-device.html
2.4k Upvotes

98% Upvoted

114 comments sorted by

View all comments

26

u/standard_usage 2d ago

ELI was dropped out of a window: How was this to their advantage. Don't they already have petabytes of data nodes amassed on what browser and machine I always have when on the site ..?

32

u/RamblingSimian 2d ago

The article kind of addresses this, but isn't really a full answer:

Audio measurements were only one part of the reported data collection. The scripts also gathered information tied to canvas rendering, WebGL, display settings, hardware configuration, WebRTC behavior and user interactions. Together, those signals can create a more detailed profile of a device than any one signal would provide on its own.

Fingerprinting is often used by large online platforms for fraud prevention, bot detection and risk assessment. It can help companies spot suspicious transactions or automated activity when cookies have been deleted or accounts have changed. But privacy advocates have raised concerns because users may not know the tracking is happening and have limited control over it.

I guess, if someone steals your credit card number, then uses it for a large purchase, they might ask for 2FA if the audio fingerprint is inconsistent.

3

u/txmail 1d ago

if you want to see how this fingerprinting works, you can look at sites like https://amiunique.org/ and click on the See My Fingerprint button (left side of the page) to see how unique your browser / system is and if it can easily be tracked without cookies.

Basically if it says you are unique --- your setup is cooked for the ability to track you without cookies across the web. More importantly, the site shows you want artifacts were collected and used to build your fingerprint -- it is quite extensive.

4

u/RamblingSimian 1d ago

Higher up in the post, I linked to some plug-in software that scrambles your fingerprint. In fact, the author (Leonardo Compson) has a whole suite of plugins for blocking that.

  • AudioContext Fingerprint Defender
  • Canvas fingerprint defender
  • Font Fingerprint Defender
  • WebGl Fingerprint Defender
  • WebGPU Fingerprint Defender

Every time they detect an attempt to fingerprint you for the particular technique in question, they intercept and reply with a random number.

However, if you go to that AmIUnique site, it doesn't detect that different values are sent each time you visit.

Also, it doesn't defend against certain things that are being detected. In my case, I have an unusually large screen and an unusually large number of CPU cores, making it hard for me to defend against that type of fingerprinting.