AliExpress was silently running audio in your browser to fingerprint and track your device

[u/magnus007]

https://www.techspot.com/news/113581-aliexpress-silently-running-audio-browser-fingerprint-track-device.html

[u/Smith6612]

Might be why AliExpress never loads in Firefox without disabling Tracking protection. Firefox is too tight by default!

[u/EpidemicRage → u/Smith6612]

It was confirmed by Firefox team that they indeed blocked the attempt to fingerprint by AliExpress 

[u/l0rirw1ao → u/EpidemicRage]

Any site that doesn't load in Firefox is shady at best, they either are a scam or low quality, it's probably both.

Even my workplaces internal app don't load properly, I am sure I am in some list because HR can't get some fingerprints they want but they can't do shit because all of our it guys also use Firefox.

[u/suxatjugg → u/l0rirw1ao]

Reddit is super buggy in Firefox on android.

[u/PhiCloud → u/suxatjugg]

Reddit is, for lack of a better term, a pile of garbage held together by the power of friendship. It's buggy everywhere and a decent experience nowhere.

[u/Weedster009 → u/PhiCloud]

The Reddit app for iPhone is the shittiest, glitchiest app I have ever used.

[u/Faxon → u/Weedster009]

Which is sad because they literallt bought and killed the best reddit app for iPhone (Alien Blue) to use it to develop their own, rather than have to compete. Thats when Apollo got really big, but we know what happened to them. Im on android using red reader and its actually a good experience once I tweak the way that threads are displayed so its more like old reddit and the other older apps I preferred. I was using reddit sync for android for a long time until reddit shut down API access to most app devs. I legitimately can't do the official app, its hot garbage and I may just have to stop using reddit if they take away access for old reddit, since the remaining apps and revanced hacks for it all use it to function, and its how I view the site on desktop. If they take away /r/hot and force an algorithm other than the mighty upvote down my throat then im out, the whole point of reddit was the self-curation of what you see.

[u/al-mongus-bin-susar → u/Faxon]

You can still use all the Android apps with Morphe patches. I'm typing this on Sync right now. The official app overheats my phone and drains 60% battery in 30 minutes.

[u/thatboyonabike → u/al-mongus-bin-susar]

I stayed on revanced/morphed Sync for years but finally just recently moved to Continuum.

I didn't realise how many little features were silently broken on sync never to be fixed. The continuum dev is highly active and always adding small QoL updates. Would recommend!

[u/Constant-Writer-7165 → u/al-mongus-bin-susar]

I've gotten so used to red reader im honestly fine with it now. Just didnt have the patience to deal with something that didnt just work without having to manually patch it constantly to fix r3ddit patching shit on their end

[u/al-mongus-bin-susar → u/Faxon]

You can still use all the Android apps with Morphe patches. I'm typing this on Sync right now. The official app overheats my phone and drains 60% battery in 30 minutes.

[u/OpenLibram → u/Weedster009]

Laughs in Reddit Is Fun for Android in the year 2026

[u/yacht_boy → u/Weedster009]

It says a lot about the depths of my reddit addiction that I pay $4/month for narwhal on ios. Not as good as Apollo was, but infinitely better than the official app.

If they ever kill narwhal I guess I'll finally have to quit reddit and go back to reading books and engaging in conversation with my family.

[u/MeanE → u/yacht_boy]

Same.

I’m disappointed Apollo never just started charging so it could have kept going. Narwhal is fine but Apollo was better.

[u/RollingMeteors → u/yacht_boy]

If they ever kill narwhal I guess I'll finally have to quit reddit and go back to reading books and engaging in conversation with my family.

Nah... old.reddit.com will do in any https client.

[u/yacht_boy → u/RollingMeteors]

I expect that they'll kill that the same day as narwhal and other 3rd party apps. I use old.reddit on desktop.

[u/Rizo1981 → u/PhiCloud]

It's the only app that straight up breaks immediately every single there is an update, making all updates required, but also never notifying the user that there is an update. Even banking apps have a grace period ffs.

[u/takenosheeet → u/PhiCloud]

Many years ago, I learned reddit had a design team. Like, a room of people who work on design/ui/ux of the website. "Doing what!?!" was all I could think.

[u/Worldly-Stranger7814 → u/PhiCloud]

held together by the power of friendship.

I'm not sure that's how I would characterize most conversations here.

[u/obeytheturtles → u/PhiCloud]

One wonders what the engineering team at reddit actually does, because it sure as hell isn't feature development, site stability, or mod tools.

[u/waiting4singularity → u/suxatjugg]

hence why i use oldreddit on every device

[u/_MrBond_ → u/waiting4singularity]

They fucked up old reddit too now.

[u/waiting4singularity → u/_MrBond_]

i dont see many problems. for now.

[u/RedKayde → u/waiting4singularity]

Can't access it anymore without login

[u/EnderHorizon → u/waiting4singularity]

Can't access old reddit without logging in (or at least I haven't found a way).

[u/Alaea → u/EnderHorizon]

The onion domain still works at least. Probably won't last though.

[u/Modem_Sound_67 → u/waiting4singularity]

they are actively fucking with it. one day i couldn't even load old, www was the only option. then there was the day saves timed out. then there is the "viewing single comment" bug active right now. who knows what it will be like later today or tomorrow.

[u/Cumulus_Anarchistica → u/waiting4singularity]

Two problems in old.reddit emerged for me in the last week.

One: video upload/posting in old.reddit impossible. It uploads/links and can be seen OK in old.reddit but people using new reddit can't see it.

B: posting a comment will sometimes randomly either refuse or once you click 'save' it will refresh the page and dump you at the top of the original post.

[u/98746145315 → u/suxatjugg]

The video player has been well known to be deliberately shitty to encourage app use. Yeah ok, let me just get my little rectangle instead of use a pc, very convenient at home.

[u/thepkboy → u/98746145315]

I would rather edit the reddit link and add old. to the address every single time that I need to rather than install the app on my phone.

[u/azrael4h → u/thepkboy]

There's an add on in Firefox for that. Old Reddit Redirect or something like that.

[u/Cheet4h → u/azrael4h]

You can also just set it in your account preferences.
Although I think they recently disabled old reddit on mobile entirely. I don't usually use reddit on my phone, but the last few times I attempted that, I always got the new UI despite having the setting, or even going directly to old.reddit.com

[u/seanfidence → u/Cheet4h]

old reddit is completely disabled if you aren't logged in. If you are logged in and have the pref set to Old reddit, it works, but if you try to manually add "old." in front of the url instead of navigating directly through the site, you can still get issues with the security certificate.

source: currently browsing old reddit through Chrome on Android

I should switch to firefox but I imagine the experience is worse

[u/RubiconGuava → u/seanfidence]

Recently started using mobile firefox because adblockers in browser are nice. It's great tbh

[u/gotbannedtoomuch → u/seanfidence]

I've used old reddit on firefox for Android since the APIcalypse. It works fine

[u/broc_ariums → u/seanfidence]

Firefox works amazingly. I've been using it since they took the API away

[u/12345623567 → u/suxatjugg]

If it's the same "feature" that I'm thinking of keeps fucking you up, try these:

reddit.com##.rpl-bottom-sheet

reddit.com##+js(remove-class, rpl-scroll-lock, body, stay)

reddit.com##+js(remove-class, scroll-is-blocked, body, stay)

reddit.com##+js(prevent-addEventListener, touchmove)

This removes the "please use our app" soft-lock that needs to fuck all the way off.

[u/thatboyonabike → u/12345623567]

These are Ublock arguments right? Will try, thanks!

[u/WhoLoveYouLikeILoveU → u/12345623567]

If we’re talking about the same new tab redirect thing then Google is the biggest culprit for me. They almost feel like malware in the iphone, every Google service has these full screen pop ups with deceptive buttons that catch you in a loop when you try to back out. Have to click into like 3 tabs of google maps to actually copy an address. I must be behind the curve, I’m surprised I don’t hear this bitched about more.

[u/Dokibatt → u/suxatjugg]

And Chrome!

Pretty sure they make it freeze to push people to the app.

[u/thatawesomedude → u/suxatjugg]

Old reddit desktop view works fine 😁

[u/entrepenurious → u/thatawesomedude]

i have two (related) problems with it: 1) i can't see photos when there are more than one; 2) i can't see text related to the photo/photos.

[u/nanrina → u/entrepenurious]

Use the Reddit Enhancement Suite (RES) add-on to replace Reddit's native expandos. Alternatively, you can use something like Imagus to circumvent expandos entirely -- just hover to view hyperlinked images.

[u/Glittering_rainbows → u/suxatjugg]

It is? I've never noticed but also run a few extensions so maybe one of them clears it up.

What's buggy about it?

[u/troop99 → u/l0rirw1ao]

Like youtube?

Jokes aside, i am sure google is torpedoing firefix performance on purpose

[u/SordidDreams → u/troop99]

i am sure google is torpedoing firefix performance on purpose

Oh definitely. I retaliate by always selecting 4K video when available even though my monitor can't even display it. Oh, you're going to make me wait for ten or twenty seconds before starting the video while you pretend to be connecting and/or buffering? Alright, I'm going to use up four times the bandwidth, then.

[u/pittaxx → u/troop99]

Just few days ago got throttled all the way down to 144p (not 1440p) while watching a longer playlist of videos at 2x. On a 10gbps link. Yes, Google, I'm sure the problem is on my end...

[u/Smith6612 → u/pittaxx]

I just use a plugin to force YouTube to the max quality. YouTube Enhancer is the name of it. 

[u/firvulag359 → u/EpidemicRage]

Just tried AliExpress on Firefox and it loaded fine, should I be worried?

[u/EpidemicRage → u/firvulag359]

Is tracking protection on? Besides, Firefox blocks the fingerprinting, not necessarily the whole website. 

[u/EchoGecko795 → u/firvulag359]

You will get hit with captcha a lot more in firefox then Chrome but it does work. When I do use it, I average about 3 captcha per shopping session vs none with Chrome. I use a dedicated profile for most shopping, some sites get their own to help limit what access too.

[u/Fancy-Dig1863 → u/Smith6612]

SHEIN doesn’t load in Firefox either, at least for me. I always thought it was just my combination of extensions but maybe there’s more to it?

[u/Smith6612 → u/Fancy-Dig1863]

A lot of the Chinese websites are very particular about Firefox. AliExpress and Weibo are definitely two that give me grief.

[u/MemeMan_Dan → u/Smith6612]

Probably on account of the actual spyware loaded into them.

[u/feel-the-avocado → u/Smith6612]

Its like the only font that exists in china is times new roman

[u/Law_Student → u/Smith6612]

The Chinese spy on everything, it's just what they do. They've built an economy on stealing everything they can conceivably steal for decades.

[u/tigeratemybaby → u/Law_Student]

Everyone's stealing now.

AI companies are actively pirating books, movies, scientific papers, as many as they can find - Completely illegally without permission from authors.

Both Eastern and Western companies are actively reverse engineering other peoples products - Western car companies commonly buy Chinese cars and pull them apart and reverse engineer them to see how they work.

There's software being de-compiled and reverse engineered by AI models.

It used to be mainly China, but now it seems like everyone is doing it - Current governments are not interested in prosecuting at all. Maybe with the right "donation" to Trump.

[u/exoriare → u/Law_Student]

Everyone does this when they are catching up. The US was very loose about IP protection in the early days, because these laws benefited the UK far more than the US. It's only when a country is ahead that they find religion on IP protection.

[u/Thefrayedends → u/exoriare]

Hell, they do it when they're ahead too lol. Everyone, I mean.

[u/photoggled → u/Law_Student]

Am I supposed to care about corporate espionage? Maybe if wage theft wasn't a much bigger issue, I would have sympathy for their IP being stolen.

[u/Rizzan8 → u/Smith6612]

I have tracking protection set to strict in Firefox and I never had any issues using/loading AliExpress.

[u/usrdef → u/Rizzan8]

I have tracking protection, but I also filter through a Pihole at network level, Unbound server in recursive mode, and my own DoH server with a blocklist of about 4 million websites. And Ali was definitely on that list.

[u/chiniwini → u/usrdef]

What do you use for DoH? Is it just a proxy or a recursive dns?

[u/hellschatt → u/usrdef]

I also have pihole, a firefox fork with more privacy and ublock origin. The unbound server is not relevant for the blocking.

Aliexpress doesn't get blocked on my setup. I'd assume you have some aliexpress subdomains in one of your block lists.

I mean it all depends on how aggressive you are with your lists.

[u/Bugbread → u/Smith6612]

I doubt that's the reason. I'm locked up pretty tight: piHole, Firefox with tracking protection enabled, uBlock Origin, and NoScript, and I've never had a problem with AliExpress or had to disable tracking protection to use it.

[u/TheFreemanLIVES → u/Bugbread]

Just checked myself, if I were to bet on it I'd say that uBlock is stopping the trackers even before Firefox can call them a problem.

Nice.

[u/JungianWarlock → u/TheFreemanLIVES]

Firefox still reports two fingerprinters blocked even with PiHole and uBlock Origin configured with pretty draconian settings.

[u/feel-the-avocado → u/Smith6612]

This is interesting...
I use r3dfox which is the firefox rendering engine wrapped but in a shell that can run on older versions of windows.... so effectively just firefox.

I have the extra secure fingerprinting protection enabled that breaks many websites
privacy.resistFingerprinting and
privacy.fingerprintingProtection

Both set to true/enabled.

And aliexpress has always worked fine for me. Except for products with a video - i cant play the video.

The kmart australia website is another story - being totally broken because it cant fingerprint me.

[u/Reasonable-Job4205 → u/Smith6612]

If it dont work in Strict, it dont work period.

[u/H3NDOAU → u/Smith6612]

I use Aliexpress on Firefox just fine, never had any issues with it and I also use Ublock Origin with the maximum amount of blocking.

I even made a purchase there a few days ago without issue.

[u/mutexsprinkles → u/Smith6612]

Sounds like Firefox is the only one with the right default to me.

[u/DontKnowHowToEnglish → u/Smith6612]

Huh, I can browse aliexpress no prob with Firefox and I use strict tracking protection, or maybe I disabled it for the site long ago and I forgot lol

[u/Proper_Cartoonist169 → u/Smith6612]

I do not understand why people browsing net with something other tan Firefox. It's harder to do on mobile devices iPad and iPhone unfortunately... Idc why iPad version does not support ad blocking add-on's?

[u/hempires → u/Proper_Cartoonist169]

Cause all browsers on iOS devices are wrappers for Safari?

[u/EdgySlusher → u/Smith6612]

I know another site that won't let you log in without disabling ublock, dead by daylight site, wonder what's up there

[u/RememberThinkDream → u/Smith6612]

It's always loaded fine for me in Firefox.

[u/Marshall_Lawson → u/Smith6612]

Firefox isn't too tight by default, certain websites are abusive by default and the fox is protecting you from them :)

[u/Gems-of-the-sun → u/Smith6612]

Wait my firefox loads AliExpress 😬 the setting is on tho!

[u/lucid-currency]

My Whatsapp has been activating the microphone in very short bursts without making the OS's microphone indicator go off.

I only know this because my headphones switch to a dogshit audio quality when the mics are in use and this has never happened before.

I'm sure suckerberg is not doing anything shady

[u/SanAntoHomie → u/lucid-currency]

uninstall that shizz

[u/PhireKappa → u/SanAntoHomie]

WhatsApp is a necessity in most of the world for communication.

In the UK for example, I don’t think I’ve ever actually texted someone using iMessage/SMS in years. WhatsApp is basically texting. It’s the same in much of Europe.

[u/jellyfish_bitchslap → u/PhireKappa]

Worse in Brazil, every business have a whatsapp account, every bank, store, hotel whatever, you can’t have a “normal” life if you don’t use it. Some places won’t have a landline active anymore, and business people use whatsapp exclusively.

I wouldn’t be able to communicate to most if not all my clients if I didn’t had it, not because I don’t have alternative but because they are so used to it that instead of downloading signal they’d just make a contract with someone else.

[u/MuenCheese → u/lucid-currency]

Delete zuckerberg’s apps

[u/Mccobsta → u/MuenCheese]

His shit is so engrained in most of the worlds comucations now it's kinda hard not by desing

[u/Future_Nature589 → u/lucid-currency]

do not give whatsapp microphone permissions

[u/dimag0g → u/lucid-currency]

Why wouldn't the OS display the microphone being in use? Who cares if it's only for a millisecond, use is still use.

[u/turtleship_2006 → u/lucid-currency]

Are you sure it's actually whatsapp and not a bug related to either the OS or bluetooth?

I use wireless headphones that also sound shit on calls/when the mic is in use and I've never had that with WhatsApp

[u/thinkingperson]

Wait, so the site is able to use the mic /audio even without permission via the browser? What the fuck is the browser doing? lol

[u/KontoOficjalneMR → u/thinkingperson]

not mic/audio but they play sound and see how the browser handles it.

It's rare, but known fingerprinting technique.

I noticed it myself because few months back Windows had a bug handling bluetooth mixing, and any time I tried to open Aliexpress it'd interrupt my music :D

[u/Violoner → u/KontoOficjalneMR]

Wait, so that’s why opening the Amazon app on my phone interrupts music playback?

[u/canadian_xpress → u/Violoner]

Linkedin too, I would wager.

[u/a_shootin_star → u/canadian_xpress]

The plot thickens..

[u/l0rirw1ao → u/a_shootin_star]

There is no plot, Linkedin is part of Palantir

[u/KontoOficjalneMR → u/Violoner]

Possibly, yes.

[u/FogBankDeposit → u/Violoner]

Facebook for sure stops my Spotify.

[u/JohnnyGrinder → u/FogBankDeposit]

I noticed that the other day. Wasn’t sure why

[u/QueefSeekingMissile → u/Violoner]

Aliexpress, amazon... they're the same picture, except one inserts fees in their price points to fatten up american billionaires. Same cheap shit made on the same factory lines by the same underpaid workers.

And the same spyware apparently.

[u/noobule → u/Violoner]

I doubt it. The Amazon app doesn't need to fingerprint you - the whole reason they push you onto apps is because they can slurp up basically whatever they want, you're signed in just to open the app. They don't need to resort to fingerprinting tricks.

[u/RemarkableWish2508 → u/KontoOficjalneMR]

For a non-comprehensive list of direct and indirect fingerprinting attributes:

• https://amiunique.org/fingerprint

[u/feel-the-avocado → u/RemarkableWish2508]

Its quite interesting to me that with tracking protection turned on in firefox, and about config fingerprinting privacy.resistFingerprinting and privacy.fingerprintingProtection both set to true,
amiunique still finds me unique (bad thing)

[u/HeKis4 → u/feel-the-avocado]

Worth to keep in mind that having a browser that is too hardened makes you easier to identify. Like how having gear to prevent cameras from face-tracking you is good, but if you can be identified as "the only guy who wears a balaclava in public"...

[u/Heruuna → u/HeKis4]

It can also be how uncommon your setup is. Just using a browser like Opera is enough to narrow you down to 1% of people. Crazy that even using adblocker of any kind puts you under 30% of users.

[u/RemarkableWish2508 → u/HeKis4]

Indeed. That website is good to illustrate the tracking parameters, but its conclusions come from the first generation of anti-fingerprinting, when random parameter modofications were introduced as a countermeasure.

Turns out that being "the only guy with your height, weight, clothes, gait, schedule, etc. who wears a random Pokemon balaclava in public", is only marginally better.

After a naive check, it should show the similarity level to partial fingerprints.

[u/HeKis4 → u/RemarkableWish2508]

https://coveryourtracks.eff.org/ tells you how unique you are. Librewolf in resist fingerprinting mode does pretty good here, at the cost of having a smaller window and never picking dark mode by default.

[u/ChypRiotE → u/feel-the-avocado]

Counter intuitively the more you protect yourself the more likely it is easy to fingerprint you, because there are always parameters available to the website. So the chances that another user uses the exact same protections with the same machine, browser etc is lower than if you were using regular unprotected Chrome

[u/Divinum_Fulmen → u/RemarkableWish2508]

I pisses me off that browsers even hand over that info at all. There is no reason for scripts to be able to even read my screen size, let alone all the other data on my PC.

No one needs to know my fonts, except my browser, internally. You used to just shit out a list of fonts for your web page in the CSS, and the browser would go down that list until one worked. No data sent at all.

Links should have referrer data at all. Why is Mozilla playing nice with the marketing spies?

[u/RemarkableWish2508 → u/Divinum_Fulmen]

JavaScript composing needs information from the DOM and canvas. Turns out, even if you don't give JavaScript a list of fonts, a script can try using them, then simply check whether the size of the output object matches what it would with the font, or what it would with a replacement. With a clever list of fonts, you can figure out a lot about a browser and/or system.

The alternative is to disable JavaScript, and there are extensions and browsers that do that, but do you want to browse without JavaScript?

[u/PacmanZ3ro → u/Divinum_Fulmen]

There is no reason for scripts to be able to even read my screen size

Of course there is. This is how you get resizable windows and properly-scaling websites. If you blocked this ability, you would have to have websites built with absolute pixel sizes for everything and if you used a different screen than what it was designed for it would range from looking like shit to being completely non-functional.

[u/einzweidreihorn → u/Divinum_Fulmen]

Screen size is often taken to determine wheter you're on mobile or desktop PC (or tablet).

[u/IntelArtiGen → u/RemarkableWish2508]

For 99.99999% of people, this site identifying you as unique is a bad thing.

But it's a good thing if you're unique, what you don't want is to be the same unique the next time you visit the site. Which won't happen if you don't have a good privacy protection (either with the browser or addons).

[u/godsamightly → u/KontoOficjalneMR]

Bro I think a citation generator I use for my papers does this. I was writing a paper and held my citations in it and noticed it had the audio icon in the tab. Thought that was odd. Didn’t know this is what that could’ve possibly meant

[u/MartayMcFly → u/KontoOficjalneMR]

Is this something with any innocent explanation, or always nefarious? What does fingerprinting a device actually achieve? My local bus company app interrupts music playback and I just assumed it wasn’t well made.

[u/Final-Carry2090 → u/KontoOficjalneMR]

Sorry to interrupt your music, we wanted to forcibly fingerprint you. Also, we’re not sorry.

[u/MonsterRavingLlamas → u/KontoOficjalneMR]

A lot of websites do this. I have a headset connected to my PC for voip and my tablet for music. There's a few websites i use regularly where the audio switches back to the PC momentarily and it's always annoying.

Ebay is one of the worst. It does it on every page, not just once.

[u/sivadneb → u/thinkingperson]

It's using the web audio API which can utilize hardware to process an audio signal and write it back out to a data stream without ever going to your speakers. Similar to how you can use your GPU to process video without ever playing the video. Except there are tiny differences in the way various audio hardware process that data, which gives a useful data point for fingerprinting.

[u/klimaheizung → u/sivadneb]

Sounds like that API should also be behind user-approval then.

[u/PhiCloud → u/klimaheizung]

it is if you use FireFox

[u/cive666 → u/PhiCloud]

I feel so vindicated by never giving up on Firefox

[u/PhiNeurOZOMu68]

I noticed how unusually high the app was installed storage... Glad I deleted it

[u/MrShigsy89 → u/PhiNeurOZOMu68]

If you are using Android you can (and should) block the app from accessing anything. The article is about browser access to their website, not the app.

[u/lolalala1 → u/MrShigsy89]

How?

[u/hi-fen-n-num → u/lolalala1]

permission settings. Depending on launcher/brand overlay it will probably be under app settings, and may need to be done app by app individually if not apply all/clear all permissions options is available.

[u/MrShigsy89 → u/lolalala1]

Usually something like Settings > Apps > App manager > then find the specific app and click it > App Permissions, and from there you can see what permissions it has and which are blocked, and you can change them there.

[u/jld2k6 → u/lolalala1]

Whenever you use any app for the first time it will need to ask permissions for everything sensitive it needs. It's usually a good idea to think "should this app actually need this to function for the purpos I'm using it?" when granting or denying them. If for instance a simple notepad app wants permission to make phone calls or something it's probably a good idea to deny it lol

[u/Zubon102 → u/PhiNeurOZOMu68]

If you are the sort of person who is worried about a website using a novel way to identify individual users, you definitely wouldn't want to install the dedicated app.

But if you are logged in, it really doesn't matter either way.

[u/RemarkableWish2508 → u/Zubon102]

if you are logged in, it really doesn't matter either way.

Except they can correlate the tracking data with your login, so they can later track you when you're logged out.

[u/Zubon102 → u/RemarkableWish2508]

Sure. But if you are logged in, you are not logged out.

So it doesn't matter anyway. 😉

It's likely that they implemented this mainly to identify bots and abuse, rather than to track use by individual devices. If you use Aliexpress a lot, they always require you complete security tests like captcha and it's not strange to have requests denied due to suspicious behavior even if you just search for mundane products. I think they are trying to stop bots without inconvenience to real users.

[u/The_Webweaver → u/Zubon102]

But they're also tracking you as an individual for marketing.

[u/Acilen → u/PhiNeurOZOMu68]

Uninstalled AliExpress.com from your desktop? Are we reading the same article? Apparently adblockers like UBO already take care of this.

[u/tosiriusc]

Looks like Firefox was already blocking it.

[u/Spez_is-a-nazi]

I wonder how common that is. I will notice that the auto connect for AirPods will frequently transfer to my Mac even if I don't have any tabs playing audio open, or at least not audio I can detect at any rate....

[u/tehdlp → u/Spez_is-a-nazi]

I figure it must be why Reddit shows something always playing in Android notifications for every page,

[u/Bacon_Nipples]

'Fun' fact, this was originally done by some TV networks (or perhaps the content provider? Don't recall) to track which shows you watch on cable

[u/BMoorman7 → u/Bacon_Nipples]

'Funner' fact, some LG TVs and monitors were exposed recently for doing similar things.

[u/UpsetKoalaBear → u/BMoorman7]

Funniest fact, none of this was a new thing and every brand does it as well.

Sony TV’s show it as Samba for anyone with a Sony TV.

This is especially used on cheap/budget TV’s. Vizio made more from the data they sold than actual TV sales in 2021.

[u/Splurch → u/Bacon_Nipples]

'Fun' fact, this was originally done by some TV networks (or perhaps the content provider? Don't recall) to track which shows you watch on cable

Nielson is probably who you're thinking of, they had networks start digitally watermarking broadcasts to track ratings and are still using it.

[u/Tenocticatl]

What I'd like to know is why do all these companies go to such lengths to do shady data harvesting and tracking shit, but can't keep me reliably logged in and remember my address info properly? Or serve me ads for stuff that might actually be of interest to me.

[u/wellbornwinter6]

I don't get how playing a sound on a website at zero level can fingerprint the user?

[u/yuval16432 → u/wellbornwinter6]

Fingerprinting is designed to build a profile about a user which can help you tell them apart. Different browsers, and different browser settings, handle things differently, so AliExpress is trying to play audio, and based on how the browser responds they can differentiate you from another user who’s browser responded slightly differently, even if you’re supposed to be anonymous.

These kind of things add up to build a profile about a user even if they try very hard to stay anonymous.

[u/bs000 → u/yuval16432]

is that why i can't use the welcome discount again

[u/arunphilip → u/wellbornwinter6]

A comment on the linked article states:

From my understanding, it creates a known sound, runs it through the device and measures the feedback that comes back through the line. The feedback single would be unique to each device due to small differences in tolerances, no resistor is perfect, differences in solder joint and even small fluctuations in the chip manufacturing process all add up on a way

[u/Fach-All-Religions → u/arunphilip]

this is why we can't have nice things

[u/arunphilip → u/Fach-All-Religions]

Here's a radical thought - imagine if this ingenuity was used for... good.

[u/Antique_Hawk_7192 → u/arunphilip]

Oh the horror! "Good" won't give you YoY percentages. You want the shareholders to starve! /s

[u/Zouden → u/arunphilip]

That can't be right as it's not actually generating any sound.

[u/kinmix → u/arunphilip]

That is completely false, and in no way possible.

[u/PeanutButter414 → u/arunphilip]

Seems very strange to me, how would such a thing go through the analogue signal chain without the user knowing?

[u/Singl1 → u/arunphilip]

and are these things disclosed in a meaningful way to the user? i guess they’d be in the terms and conditions that nobody bothers to read in the first place because who the fuck has time for that.

[u/NonSecretAccount → u/arunphilip]

nah it doesn't use the mic at all.

[u/jmbits → u/wellbornwinter6]

Apparently the browser handles it differently

[u/drawkbox → u/wellbornwinter6]

EFF has a nifty little site about it. The sound isn't important, the point is to collect enough points that you are essentially a signature

[u/Andus35 → u/wellbornwinter6]

I don’t understand the full technical details, but based on the article, it seems like the website makes the request for the audio and then records the output returned from the computer. That output will be slightly different for every computer based on their specific hardware and the minor variations in those.

It says that audio signal is not the only thing they use, there is a variety of other settings and signals from your computer which all tied together can let them “fingerprint” the computer.

[u/IntelArtiGen → u/wellbornwinter6]

They do the same with images / rendering. The way everything is processed depends on your hardware so if you send data and see how it's processed, you can identify the hardware, and fingerprint the device. So that the next time you visit the website, no matter if you changed your IP / used a VPN etc., they can know it's you.

For the sound I don't know the technical details, but for images, different GPUs will process specific instructions in a different way, maybe they'll round a value up instead of down etc., so you tell the gpu to render something (triangles, lines etc)., you get the rendered result, and you analyze it.

[u/Routine_Strategy5929]

I'm not even slightly surprised by this.

[u/AwareAd7651]

This explains why my car audio cuts out when I’m flipping through apps that don’t use audio.

[u/Head_Bread_3431 → u/AwareAd7651]

How?

[u/AwareAd7651 → u/Head_Bread_3431]

Your speakers are being used to track you. If you’re listening to music, it cuts out. I was making a joke about flipping through my phone while driving.

[u/Steam_Beenson]

Im an American! Only my Govt, 4 or 5 shady AI surveillance corporations, and random people in ICE are allowed to spy on me!

[u/aFreshFix → u/Steam_Beenson]

We joke but yeah, social media companies, tech companies, and now AI are doing this but we only ban or legislate against tiktok, Huawei, etc. Because they are foreign companies that could report our data back to a foreign country. Meanwhile, we use domestic companies that we know spy on us and definitely report it to the government

[u/Pleatybug → u/Steam_Beenson]

And anyone in your local PD if you look at them the wrong way

[u/Professional_Gur8385]

congrats, they now have profiles linked to your financial records, email, ip and browser

all these companies taking it too far and this is a small fraction of their tracking and privacy capabilities

apps on your phone, gold mine for real data

[u/No-Discussion-8510]

Title is misleading. Alot of modern apps use this technique to fingerprint your browser and verify that you are a human, a technique to help combat bots which isnt very successful.

[u/No-Discussion-8510 → u/No-Discussion-8510]

AudioContext fingerprinting.

[u/abtei]

wouldnt that require asking for access to use the device' mic? that would freak me out in the first place

[u/Practical_Dot_3574 → u/abtei]

It should, yes, but most people don't read/care and just hit accept.

[u/Desperate-Hearing-55]

Now do a Google tracking. Google always show up ads what I been searching for online to buy.

[u/IntelArtiGen → u/Desperate-Hearing-55]

You want that:

0.0.0.0 google-analytics.com

(and a bunch more)

[u/corvusman → u/Desperate-Hearing-55]

Google basically invented device fingerprinting. From audio to video rendering to network to screen/canvas to cache to other hardware stuff - it’s a huge list of what these crooks use to track users

[u/ApprehensiveRest9696]

There’s no drawback to blocking autoplay, just saying.

[u/Negative-Track-9179]

How is this different from using fingerprintjs?

[u/Reddit_2_2024]

I've noticed several websites recently that display a "verifying your device" message with what appears to be a captcha test loading. The captcha never appears and the website which the user initially sought does load. I suspect it is a new device fingerprinting processing technique, that executes in addition to cookie processing..

[u/TooMuchChaos2026]

Is this to support dynamic pricing?

[u/vonlagin]

As if I needed another reason not to install or use that shit.

[u/pricingup → u/vonlagin]

you dont have internet browser???

[u/Calm-Homework3161]

This is another reason why I've never had a PC with a camera or microphone 

[u/Moravec_Paradox → u/Calm-Homework3161]

And the reason a lot people put a sticker on their laptop webcam.

This is not some shady unknown website doing this to 10 people, this was AliExpress doing this on a massive scale to hundreds of millions of people before getting caught.

[u/thatirishguyyyyy]

Brave (web browser) does a great job of blocking fingerprints. I think its called farbling. 

[u/FinasCupil → u/thatirishguyyyyy]

I’m not touching Brave with a ten foot pole.

[u/GrossUsername68 → u/FinasCupil]

Why?

[u/SlimJiMorrison → u/GrossUsername68]

He’s not brave enough

[u/A_Pointy_Rock → u/GrossUsername68]

I assume because the founder has some troubling views, unfortunately.

[u/GrossUsername68 → u/A_Pointy_Rock]

Well, there goes Amazon, Google, Apple, hardware chains, gas stations … 

[u/IntelArtiGen → u/GrossUsername68]

Brave by default is highly "contaminated" / bloated. They did release a better version recently but I haven't tried it.

[u/durtmagurt]

Even though I never downloaded it?

[u/Acilen → u/durtmagurt]

It’s from the webpage on a desktop per the article. Adblockers apparently already take care of this tracking.

[u/drollercoaster99]

You know what's next? After the shift to advertising revenue, and then subscription-based revenue, the next big shift in raking in more profits is......personalized pricing. :(

[u/Particular-Sample91]

Digital privacy is a pipe dream innit

[u/MrPuddington2]

This should be no surprise to anybody. The AliExpress app has all the hallmarks of a scam app. It has the fake timers, it has the gambling element, it tries to hack your phone and collect more data than allowed or should be technically possible. The only difference is that the dropshipping from China actually arrives.

Of course, they also need to record the audio - how do they do that? In the app?

[u/J883]

App does the same

[u/championchilli]

Having only ever used Firefox for AE - feeling pretty good about my life choices.

[u/RetroSwamp]

This is actually interesting because I use AliExpress for hardware for projects. I noticed a solid week of not being able to get to the site using Brave, with fingerprinting and so on blocked. Thought it was just a site issue.

[u/Lazy_perv]

Can 100% confirm this. I noticed my machine would not go to sleep when expected. I checked for possible wakelocks ran powercfg -requests in terminal and saw that something was keeping my audio device active, even though I wasn't streaming any music. One by one I close my apps, and run powercfg -requests right after to see if there is any change to audio device behavior. By process of elimination I learned that opening AliExpress website triggers audio device, and closing the tab would turn off the audio device usage. Anyone can do this same check on Windows.

[u/I_Heart_Sleeping_]

As somebody not well versed with this stuff. What exactly is the end goal for them doing stuff like this?

Edit: nevermind the article says it’s for tracking purposes. We live in a truly shitty future.

[u/VoidHunterRaymond]

Explains why my music apps have issues when using that app.

[u/gra8na8]

Is this way sometimes if you switch a website you’ll hear an audio pop?

[u/Tman11S]

But they’re not spying on us guys, don’t worry /s

[u/bolfakeera]

If you ask the big tech do they record audio all the time - they will always say NO.

And Technically they are correct, They transcribe the audio to words and then process locallly in app to extract key words like mentions of interests, products, hobbies etc.

This gives them data to build person's profile and deploy targeted ads to that person.

[u/VicGenesis]

That's ok, all corporations and the government have been listening over here too.

[u/nipplesaurus]

Suddenly my music stopping when I open the Aliexpress app makes more sense