China's AliExpress caught using an ‘audio fingerprint’ trick to track visitors
Chinese retailer AliExpress has been found using an audio trick to fingerprint visitors. This technique analyzes inaudible audio signals processed by web browsers. Researcher Matthew Callaghan discovered this method after noticing his phone audio stopped playing. Firefox and Chrome browsers now have protections against this specific audio fingerprinting method. AliExpress employs multiple other…
Chinese e-commerce giant AliExpress has been discovered employing an unconventional method called "audio fingerprinting" to track website visitors. This technique, discovered by researcher Matthew Callaghan, involves analyzing inaudible audio signals processed by users' web browsers. When Callaghan repeatedly visited AliExpress, his phone audio stopped playing through his Bluetooth headphones, indicating that the website was using this method to identify and track him.
Upon investigation, Callaghan found two complex scripts embedded in the AliExpress homepage that generated a graph analyzing WebAudio readings from the browser. These scripts created a Sawtooth wave – a type of waveform commonly produced by digital audio systems – and measured the frequency data after the signal passed through the browser's audio implementation.
The audio gain was set to zero, ensuring the visitor couldn't hear the signal, yet the system still processed the information, allowing AliExpress to collect data about the visitor's browser and device.
This audio fingerprinting technique can be effective because differences in how browsers and systems process audio can produce unique results. However, Firefox and Chrome have implemented protections against such fingerprinting since version 118 (2023). For Firefox, the browser began using its own consistent math libraries, while Chrome uses its own libraries. Consequently, the technique is ineffective on these browsers. Safari users may also be protected, although Apple has not confirmed this.
AliExpress uses a multitude of tracking methods beyond audio fingerprinting, including canvas rendering, WebGL renderer information, screen and viewport dimensions, device pixel ratio, hardware concurrency, installed browser plugins, WebRTC behavior, supported audio and video formats, WebRTC behavior, browser performance timing, and more.
By combining these measurements, the website can gather comprehensive information about a visitor's browser and device, even though the audio fingerprinting technique appears outdated due to browser updates that have reduced its effectiveness.
Written by urgent.news from Times of India's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
