AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint(blog.laserphile.com) |
AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint(blog.laserphile.com) |
Why? Are you afraid of robots making you rich?
I wouldn't be surprised if what I'm feeling is all a psychological thing where consumers associate jank with low prices so that's why sites like AliExpress and Temu look like a complete technical mess when in reality they're doing pretty advanced stuff like this.
The title of the article literally mentions "WebAudio", and the first paragraph states that the author is using a PC. The second paragraph mentions Chrome and Firefox.
Apple and the App Store have zero involvement here.
I'd argue it's "silent" though: aliexpress wakes up my audio card if nothing plays, which results in a very faint "pop" sound every time I open the tab.
It's been this way for ~3+ years at least.
Thanks for investigating! Makes sense it’s also in the taobao app on ios too.
Thank you very much.
Uninstalling the app fixed it up.
I remember trying I think it was the Tor browser, being puzzled at why the viewable area of the window constantly changed when resized but would never occupy the full window.
I feel a little silly now.
No sound playing but the audio would change like the microphone was being activated. I checked permissions to make sure there was no mic access and figured that they were fingerprinting.
what filter ?
To block the scripts open the uBlock dashboard, select My filters, and add:
! AliExpress AWSC fingerprinting scripts
||assets.aliexpress-media.com/g/AWSC/uab/*/collina.js$script,domain=aliexpress.com
||assets.aliexpress-media.com/g/AWSC/fireyejs/*/fireyejs.js$script,domain=aliexpress.commost of the prices change during checkout in the most frustrating ways. one u ready to check out, and provide ur payment into, and click to pay... they interrupt this fake checkout with a popover, inform u the price is actually much higher, and dangle a button which is one click to accept the new higher price.
this is total scam behaviour and probably illegal in most US states.
This is nonsense. Safari also supports Web Audio. Safari does not, however, support Microsoft Windows, which is why the article author didn't mention it.
Moreover, all web browsers on iOS have to use Apple WebKit, so Web Audio support is not actually the fault of the non-Apple browser vendors.
Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content...
Now I wonder, does this also allow websites to continue running in the background on mobile browsers? Playing media is one of the very few things that can convince iOS Safari to keep a tab running indefinitely, in my experience.
I wonder what kind of person says 'Yes' to this prompt. It gives me the heebie jeebies.
I can only assume that there are legitimate reasons for this as well, e.g. websites preparing/maintaining audio context for lower latency when they intermittently play audio etc.
Every time an article like this comes out, people wonder about aliexpress instead of why their browser allows this in the first place.
When most sites do browser fingerprinting using audio, they use an 'OfflineAudioContext' - which unlike a normal AudioContext, doesn't run in real time and send its output to system's loudspeakers; instead, it runs faster-than-real-time and outputs to an AudioBuffer. So the browser can easily tell no sound is being played.
For example - you can tell the browser to create a 10kHz square wave, feed it to a GainNode then a DynamicsCompressorNode, output to a buffer, then hash the contents of that buffer - which gives you a browser fingerprint, because of subtle differences between browsers.
A colleague of mine made a recent post here: https://ritter.vg/blog-webaudio_alibaba.html
Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.
@FireFoxDudes You need to be addressing fingerprinting
It can be mitigated, a bit, but I don't see how browsers can win that battle.
Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).
A colleague of mine made a recent post here: https://ritter.vg/blog-webaudio_alibaba.html
we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored
To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my Android phone. It shows a number of sites. Nothing in first party and these that I must fully enable to make the site work (css, image, script, xhr)
* aliexpress.com
* ase.aliexpress.com
* it.aliexpress.com (my country two letters domain)
* umdc-global.aliexpress.com
* aidcgroup.net
* ase.aidcgroup.net
* 67372.ase.aidcgroup.net
* alibaba-inc.com
* epss.alibaba-inc.com
* alicdn.com
* ae01.alicdn.com
* assets.alicdn.com
* aliexpress-media.com
* ae-pic-a1.aliexpress-media.com
* assets.aliexpress-media.com
* aliyun.com
* acjs.aliyun.com
Scary list, right? According to google aidcroup is
> Alibaba International IPP Platform
> Alibaba International is committed to the protection of intellectual property rights. Right holders and their agents can enforce intellectual property ...
Let me add a /s to the last line
There are two more sites that I can completely block
* googlesyndication.com
* pagead2.googlesyndication.com
so even Alibaba runs ads on Google.
I did not instrument the browser like the author of the post did, so I don't know where the audio comes from. There is nothing listed in the media column of uMatrix. This does not mean that the post is inaccurate. It could be that the browser gets the audio stream from a request in one of the other categories.
uBlockOrigin blocks two of other requests.
1. https://g.alicdn.com/code/npm/@ali/gmod-pop-disclosure-code/...
and this one that I anonymize
2. https://aplus.aliexpress.com/g.gif?logtype=0&title=WebPush Permission&pre=https://it.aliexpress.com/?gatewayAdapt=glo2ita&scr=1920x1080&_p_url=https://it.aliexpress.com/wp.html&cna=<whatever cna is>&category=&aplus=&$${beacon_mini}$$=&yunid=&=&trid=<trid>&asid=<base64 stuff>$${get_sign}$$&p=1&o=linux&b=firefox153&s=1920x1080&w=gecko&ism=other&cache=<7 letters>&lver=8.15.25&jsver=aplus_std&pver=0.7.12&_pw=0&_ph=0&tag=1&stag=-1&lstag=-1&_slog=0
Probably the audio file is coming from one of the unblocked requests but my Debian laptop does not pair with my Bluetooth earpieces so I can't test it.
I haven’t noticed this recently, but I also now have two newer Phonak hearing aids and a few iOS updates have happened. Maybe the silent Bluetooth shenanigans are less disruptive to my new aids or the programming is different. Surely shenanigans continue.
However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to.
With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing this, I'll be more willing to be bothered every time I want to play a video with audio to approve it if this bothers me.
Philosophically I hate silent video autoplays just as much as I hate autoplays with audio. One distracts your visual attention, the other distracts your aural attention, and I don’t quite understand why society has normalized silent video autoplay.
I noticed that Voice Over (iOS screen reader) crackles and randomly changes volume when using the app, but I attributed it to standard iOS weirdness, and possibly misuse of some iOS API. Now I'm thinking that this may very well be fingerprinting.
At the very least, governments and institutions should develop a framework to investigate all acquired technology. The community / civil society could also create something similar, a script that would analyse at a deep level everything that can be analysed with a piece of software even by a complete novice.
That would be unreasonable, I argue. No one should have to worry about the security of their devices and data privacy based on which OS they use. Whilst it can be argued that different OSs serve different needs, privacy and security should not be debatable. In fact, most countries have dedicated legislation for this; whether it's just, applied correctly, or serves the public before any other party are indeed discussions to be had.
Of course, I am also a horrible hypocrite and will actually use websites that use features like WebUSB or WebRTC.
Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party software isn't under any obligation to work without them.
But the platforms have done what the platforms can do, at the architecture side, really. The next stage is human-audited enforcement of malware, which this AliExpress nonsense might hopefully run afoul of.
How can they tell? For the permissions I can think of: location, filesystem, etc. it should be easy to lie/spoof.
My local 'newspaper' website is chock full of scam adverts. The print version is dignified. The website people, somehow, turn a blind eye.
And I got an advert on Youtube this week using sexually explicit language to sell pills.
Feels like standards, and expectations, have really slipped.
I’m sure some Adblock addon could do it but at the browser level would be preferred. A browser vendor that just proactively does security and “correctness” tweaks to live sites would actually be in my interests as a user
[1] https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_emai...
Of course, even though it's probably useless now, things like that hang around because it costs more for trackers to remove the code than it does to keep it in.
How much HAs reduce environmental sounds when streaming is configurable by the way, but only by the audiologist if you don't have your own programmer. I don't like the effect and prefer to just turn down the volume manually.
I tracked it down to American Express's login page (auto loads if you leave the site idle) relying on Akamai's anti bot measures polling some web Bluetooth feature, causing Chrome to trigger a BT scan: https://castle.io/research/fingerprint-harvesting-in-the-bot...
Turning off Bluetooth solves it, but that's not a great solution when using a Bluetooth mouse... and it sounds like it might be causing your issue too.
Quite frustrating as I'm often needing to hear the cashier at that point!
At least in the US, I could see that being something that the ADA prohibits.
I would suspect that this only happens when you're charging and it is likely the charger or cable not being properly shielded.
Charging only happens while in the cradle, not while worn.
I don't think you know what you are talking about
For instance, Meta and Google publish 'free' iOS libraries that firehose surveillance data back to them. The libraries are popular, so apps that use them must be allowed into the store despite taking them as dependencies.
If you can get access to .ipa files (I think you'd need to jailbreak -- apparently this stuff is encrypted by Apple) or packet sniffer, then you can get an idea of how bad it is for the apps you use.
This tool claims to do the sort of analysis I'm talking about (among other things), but I've never tried:
edit: quantity qualifier
By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission.
In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.
For a while there's been an anti-pattern where a piece of software leaves a localhost daemon running (often without proper security) for web integration.
One of the more famous abusers was Zoom: https://infosecwriteups.com/zoom-zero-day-4-million-webcams-...
XSRF vulns also have existed where e.g. a web page can blinding attempt to hit your router's page to change your DNS servers by knowing common router admin sites and default home network topologies. This isn't as useful in today's HTTPS world.
Browsers have been adding more partitioning between local and internet resources to prevent this sort of thing. But that does mean simply putting localhost entries in a hosts file to blackhole a site can now cause an issue.
I don't think many people know about it, it's made by Good Lock Labs which is basically a group of Samsung devs making advanced customization apps: https://galaxystore.samsung.com/detail/com.samsung.android.s...
You access the features from the OS volume control once installed, there's a "..." button.
Always wondered if that also works on non-Samsung phones, but it's quite useful to forever mute an app.
(One should really not tolerate such dodgy software).
Safari and Firefox allow this by default without a prompt or visible indicator (but maybe that has changed now that Chrome added its dialog).
1. Not make web browser general-purpose runtimes for arbitrary software.
2. OS builds a general-purposes runtime that's completely sandboxed. So users can run more complex software without needing to worry about cruft being installed on their system.
Unfortunately, browser builders have decided that web browsers are #2.
iOS -> Safari
Android -> Chrome
Windows -> Edge (based on Chromium, so fixes in Edge make their way into Chrome too)
~every piece of data can be used for fingerprinting. settings and preferences, browser, os, etc. fingerprinting is not its own category of data, it's the correlation of regular data.
the "pressure" ends up being: stop receiving any data at all (which would obviously break ~everything), or put up a warning (leading to fatigue).
consider accessibility settings: absolutely required for some people to browse the internet, but also extremely high-value data for fingerprinting a user.
there is no technical method to know whether a site asking about a visitor's accessibility settings is doing it so that they can properly display content or so that they can fingerprint the visitor. (i.e. there is no "evil bit")
There's always been one, but it's been defaulting to 1 ever since the Web 2.0 upgrade, and the API to set it back to 0 has been deprecated.
Switched from NoScript in the days of 'HttpSwitchboard', then over to uMatrix, but using uBo only now.
Still missing some elements of uMatrix, though.
How does it work with uBo now? Where does it interfere? What are the redundancies to check for, and letting only uMatrix(whichever fork) handle it? What to disable in uBo for it to work effectively?
There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc.
I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.
The former is traditional analytics and is not enough to uniquely identify an individual.
Not all analytics are as privacy invasive as fingerprinting.
shockingly little information is required to uniquely identify someone.
"traditional analytics" (lets just say os + browser + some hardware info) is likely to be uniquely identifying when combined with just one other sparse dataset.
>Not all analytics are as privacy invasive as fingerprinting.
fingerprinting isn't a separate category of analytics. every data point can be (and often is) used for fingerprinting.
You can set per-hostname exceptions if you like! CTRL + I > Permissions
1. Thank you, that's very nice to know about.
2. I really wish this was exposed more directly, probably from the permissions button that is already in the address bar. I can't believe Chrome does this better.
https://chrisburnell.com/html-can-do-that/
[†] Neat for me building things like tooltips and dropdowns into my web apps without using JS; not neat for annoying people with popups.
....and yes, many HN'ers were clearly happy to give there precise GNSS coordinates to some random scrote who askes for them.
b) Browser fingerprinting and the like links this position to me and my activities.
Do you not find it bizarre that many people see nothing wrong in routinely giving their precise location to anybody who asks for it?
Likewise for any other hardware access you want, and most of them are harder. How do you fake local storage without storing anything? How do you fake Bluetooth access without virtualizing an entire device? Do you fake the screen dimensions to look like something else? Input latency? Where does it stop?
No, "does this work" is among the easiest questions to answer in technology. We aren't going to win this war.
No, but you also can’t do that if the user approves your app’s permission to play audio, but has the volume permanently turned down to zero.
> local storage
Give the app a temporary, space-constrained store that isn’t shared with other apps.
> bluetooth
Don’t let apps access raw bluetooth signals, but instead ask the platform to display a pairing interface (possibly with a custom stylesheet), ask the platform to call you back when a specific device is in range, etc.
> screen dimensions
Not personal data.
> input latency
Fudge the numbers even when the user grants permission.
This isn’t a war, it’s just engineering for the benefit and autonomy of the user, and not the platforms’ commercial interests.
Fingerprinting and other quasi-malware techniques being used by desirable third party software are absolutely a war, otherwise we wouldn't have this permission structure in place in the first place. And as much as you believe the contrary, Alibaba et. al. are 100% smarter than you about how to exploit these tricks and will win.
> Not personal data.
LOL
Permissions have nothing to do with preventing fingerprinting, they have to do with user control. Every permission you add that the app can inspect is one extra bit of fingerprint, so it’s actually worse.
In TFA’s case, if the app was simply not hooked up to an actual audio sink, they would still be able to use this mechanism for fingerprinting, since it’s the processing pipeline itself that leaves the fingerprint.
Note that the article isn’t calling out for fingerprinting specifically. I’m sure AliExpress does more fingerprinting than this. The problem is specifically that they’re interfering with multipoint Bluetooth audio.
I study Apple's Privacy Nutrition Labels religiously every time I consider installing an app.
I like the ones with "Data Not Collected".
Here's a good overview of the problem: https://arxiv.org/abs/2206.02658v3
Screen real estate is precious on phones, so being able to permanently block "Install our app!" and even entire navigation categories (shorts on LinkedIn) is quite valuable.
Then you can "install" the site on your home screen or simply place it in collection folders so it's sitting ready on your "New Tab" page.
If you want an actual private Firefox Browser use a fork like Mullvad Browser, LibreWolf and Tor Browser.
I dropped their .com into a Home Screen icon, and this completely stopped (at least as far as I’ve observed). It’s definitely more janky from an experience perspective, but still easier than driving to the store.
While browsing, there are also popups offering the app approximately every third link I click. Some of them are telling me to install the app.
Unless the situation has changed recently, it's not perfectly fine, it is unusable on purpose.
They are compared / contrasted. Nobody is saying one is concretely related to the other.
Is it one of these HN usual "ChInA BaD" psychosis ?
On Amazon I never see products like that. That's why I prefer Amazon (and Coolblue and bol.com in Belgium).
Case in point, fake 2TB Sandisk ExtremePro microSD:
- £17 on eBay: https://www.ebay.co.uk/itm/336728033240 - even the images prove it's a fake (also $570 on sandisk.com)
Agreed, there's more of that on AliExpress but Amazon is not free from that either.
Amazon, in my experience, does arbitrate disputes about returns and defects, but the important point is that from a legal perspective, I don't think they have to, so you're at their mercy.
You can't even be sure that VAT is handled correctly, which local retailers can usually not get around.
Not a £1 tat, and not one off. Not that AliExpress is my choice, no, far from it. Sometimes it's better, closer to the manufacturer, that's all.
Similar to how I use Amazon Prime but would never order something I ingest, put on my skin, or (usually) wear from it.
Not elitest.
Elitism has nothing to do with refusing to buy products made with slavery.
A lot of people are critical of historic slavery whilst happily buying from Temu. That’s scummy as hell.
https://support.mozilla.org/en-US/kb/sponsor-privacy
https://blog.mozilla.org/en/mozilla/mozilla-and-google-sign-...
The only one trying to convince themselves is you...
I can't help but feel the whole Apple privacy PR will be blown in the future where some report will come out that Apple has been logging and sharing user data with NSA since 2001.
Reminds me of meat processing regulations. I can sell my animals whole to buyers through a custom processing exemption, but they must go pick up their meat from the butcher. The law says I cannot pick up and deliver it, but it is trivial to find people advertising that extra service. Reporting them does not result in any obvious action.
In both of our cases, our honesty is a liability in the marketplace, because people are ignorant of such laws (or simply don’t care). Really, they simply want the product that they want, as conveniently as possible. We are then forced to compete in the marketplace with liars and cheats.
I am sure our peers here can find countless examples in other areas where this flavor of dishonesty prevails. Hell, I would love to hear some counter examples, because I cannot help but view this state of affairs as intentional at this point.
The purpose of system is what it does (or, in this case, does not do).
At least Aliexpress doesn't have all the fake slot machine type games that temu has that always end in variations of "get $200 of discounts for your next order if you order x items from this list"
So I would register a new account for each order -- 10 USD is quite a lot of money in my country -- and saved at least a hundred on buying dev boards and other components.
Companies are not going to hire a mobile dev team to create an app to give you a way to pay them less for a good.
They hire a mobile dev team to create an app to give you a way to hand over data that you otherwise wouldn't, is technically impossible to do through a web browser, and is worth more than the discount that they give you for using the app.
This should be illegal
Like a white van with FREE CANDY written on it...
What, I suddenly need to buy Alibaba crap and I can't wait to get to a laptop browser?
Translation: They are able to mine your personal data more completely with an app installed vs the website which they can sell for pure profit. They promoted installing it to extract more value from you.
But there is another, slightly less evil, explanation that I know at least some companies have pushed their apps because of: the thinking is that if you're on their website, there is less friction to open a new tab and search for a lower price from their competitors, than if you're in their app. Obviously it's hardly any different - opening a new app (the web browser) vs. opening a new tab in the app you're already in - but the theory is that there's a slight psychological difference.
Of course I'm not saying that trying to prevent your customers from searching for better deals is a nice thing to do. Just adding that data mining isn't the only reason for some companies to want people to use their apps.
Should you ever need someone in a foreign country to do something for you, it's good to have as much information as possible at your disposal about them.
"The app is great because the website is heavily degraded".
As the sibling poster mentioned, might depend on location, but it DOES happen.
Using my computer just now, I looked at one of the emails that AliExpress sent about this order. It had a clickable tracking number displayed; I clicked it.
That brought me to their website, where I landed on a page that included the last update for my order and also a link to "View Details".
That works for me. It was very easy to where along the line my stuff is (and that it is not in the US yet).
---
Meanwhile: I also copied the tracking number from the email. I pasted that tracking number into the box at usps.com.
The USPS knows of my tracking number and they do not have my item yet. Fair enough.
I ticked some boxes and told them to send me updates, which I'm sure they'll do once they have updates to send -- just as they have done for ~decades now.
This also works for me.
"Why would anyone install a random app"
"Why would anyone use a phone to make a purchase"
--
Globally, more than half of all eCommerce purchases are made on a phone or tablet.
The fact that all uneducated crash test dummies are purchasing via dubious apps doesn't mean a seemingly educated population about computer hygiene as I would expect is visiting hn would do that as well.
And it is not about purchasing from mobile, but app vs web browser.
For no good reason in places where the phone is not the exclusive access many have to the internet (like it's for many people in the poorer places in Africa for example).
(And the number likely includes things like food delivery and digital goods like game assets and apps themselves)
For example, seemingly a bunch of places in Europe/elsewhere has disabled old.reddit.com unless you're logged in, but seemingly a bunch of people in other places can use it just fine. I'm sure what both of you are seeing is both correct, there is just something changing the experience that gets served to each of you.
Log in to use old Reddit
To keep Reddit safe, accounts are required to access old Reddit. Log in, or continue without an account on reddit.com.
It went into effect 2 months ago, there is no bypass for it by design.