AliExpress was silently running audio in your browser to fingerprint and track your device

Key Points:

• Researchers discovered that AliExpress uses silent audio processes via the Web Audio API to generate device-specific signals, enabling fingerprinting without relying on cookies, which users are unlikely to notice.
• The audio-based tracking was identified after a developer experienced issues with multipoint Bluetooth headphones while an AliExpress tab was open, revealing the site's audio processing interfered with device switching.
• In addition to audio data, AliExpress scripts collect information from canvas rendering, WebGL, display settings, hardware configuration, WebRTC, and user interactions to create detailed device profiles for tracking and security purposes.
• Privacy advocates express concern over such fingerprinting techniques due to the lack of user awareness and control, while browsers like Brave actively block these scripts and implement protections against audio and GPU fingerprinting.
• The incident highlights the ongoing tension between online security needs for fraud detection and user privacy desires to limit covert tracking without explicit consent.