Brave Accuses AliExpress Of Using Audio Fingerprinting To Track Users

Alibaba-owned online marketplace AliExpress has come under fire for allegedly using audio fingerprinting to track users, according to privacy-oriented browser Brave. Audio fingerprinting is a tracking method that analyzes minute differences in how a device processes sound to identify it without relying on traditional cookies. The practice was uncovered when a researcher observed that multipoint Bluetooth headphones experienced audio disruption when an AliExpress webpage was open.

Upon closing the tab, normal functionality was restored, prompting an investigation that revealed the website was covertly running background audio processes.

AliExpress was not recording users' audio, but rather playing a silent sound and measuring how their specific devices processed it to create a fingerprint. This was accomplished by using the Web Audio API to generate a silent signal and analyzing how it was handled by the device. Variations in CPUs, audio hardware, browsers, and other software elements can produce subtle variations that contribute to a browser fingerprint, a unique combination of device characteristics used to recognize a user or device.

The scripts reportedly connected audio processing graphs to the system audio output at zero volume, ensuring no audible output. The gathered data was then merged with other signals, such as canvas rendering, WebGL, and hardware information, before being transmitted to Alibaba's servers.

Brave criticized the use of audio fingerprinting, stating that the scripts were part of AliExpress's anti-fraud and security tooling. However, the browser emphasized that the technique used for tracking is not conducive to user privacy. Brave has been blocking audio fingerprinting and other fingerprinting techniques by default for over six years and specifically targets the scripts employed by AliExpress, requiring no adjustments to browser settings.

The browser also mentioned that fingerprinting techniques continue to evolve, including recent additions to block GPU fingerprinting, which can identify devices through graphics hardware and drivers. Brave highlighted that users on other browsers can also block the identified scripts using content blockers, such as uBlock Origin, although this might impact AliExpress functionality.