emctech

Good to know! I have added a note and link to my post.

The Web Audio API has the ability to extract frequency, waveform, and other data from an audio source, that source is generated at runtime on your device. A firefox developer did a further dive into what the WebAudio based fingerprinting can actually return in firefox. https://developer.mozilla.org/en-US/docs/Web/API/AnalyserNod...

Perhaps accessing the microphone is something else they do, however that is not the issue in my case nor what my article is about.

While it may not be effective at fingerprinting, the side effect of the attempt sure is annoying when it stops my music! Do you know if it would count as a bug if muting the firefox tab or the browser as a whole does not stop the audio stream?

I doubt the FBI will be flying to china to knock down any doors! You aren't wrong though, and countries which enforce GDPR I would expect to make noise if this was happening to their constituents.

Thanks for your input and perspective! Do you think it is a bug that the muting of the firefox tab doesn't stop the audio stream? It is frustrating that companies would use such an annoying tactic to track their users with it also ineffective.

I touched on this in my article, once the data has been collected and sent to their servers you have no idea what they do with the information. At least with GDPR it is supposed to be regulated but obviously that is not the case everywhere and websites can still lie.

ebay does this i think, someone else linked a post about port scanning

I am glad people like the write up and it is fostering a conversation! It is such a happenstance that i looked into this.

Thanks for the feedback :D

It doesn't actually stream an audio file, the scripts generate audio at runtime using a sawtooth oscillator. It also only happens after several seconds.

Someone else mentioned that cloudflare uses the webaudio for verification challenge, but only triggers it briefly.

I wonder if it is something firefox and chrome devs need to look at because if it is accessing the audio device surely it should be notified to the user.

It just annoyed me so much that it was interrupting my music!

Does it hold an audio stream open constantly or just briefly during the challenge? On AE it never stops

They said they aren't interested

The best you can do on the modern web is reduce your fingerprint footprint, though it comes at a cost of websites breaking from JS disabling, or local time zone anonymisation.

Sorry, this is my first post to HN and in the submission it looked like the description text i added would be part of the post header.

I use ublock origin and by default it wasn't blocking, i had to make a custom filter to block the scripts in order for it to prevent the audio takeover. Maybe adguard does a better job? Someone else suggested just wholesale disabling of JS but it is the nuclear option.

No, I took the first sentence of my article and then edited the rest of the intro + conclusion to keep it short for HN.

AE website on mobile is terrible, they basically force you to use the app. I exclusively use the website on my PC

Thanks for the reads

Will do! edit - How do i do this? through github issues? https://github.com/uBlockOrigin/uAssets/issues

So many website break completely with JS disabled and you end up having to enable it half the time anyway.

The script generates a known waveform, it is passed through the browser's audio implementation and then the script analyses the result after. Based on your devices settings and hardware the output will be different, e.g. a PC with analog output might have 44KHz audio output bandwidth, but a bluetooth headset might have a lower, different audio bandwidth. That is a datapoint that can be used in device fingerprinting alongside screen and viewport dimensions, device pixel ratio, browser plugins, etc.

I had noticed it before but I was browsing AE a lot today and i got fed up with it. What browser and OS are you using?

The ability to play audio can usually be permission gated with tab muting, however the methods aliexpress use bypass that mechanism completely.

Yes, I find it concerning too. I particularly dislike that windows was not aware, nor could it stop the audio stream from effecting the hardware. What other side channels like that exist? Perhaps I can be blamed for using windows

Recently I ran into a problem with my Bluetooth headphones. They support multipoint bluetooth audio, so they can be connected to my PC and phone at the same time. Opening the Aliexpress webpage causes a silent audio stream keeping the PC>headphone link active blocking my phone audio. An investigation reveals obfuscated code running device fingerprinting with a side effect being a silent audio stream that firefox, chrome and windows does not recognise but which kept the bluetooth connection active.