AliExpress accused of using silent audio to fingerprint users, developer finds

Software engineer Matt Callaghan reported late last week that his Bluetooth headphones stopped playing music from his phone whenever he visited AliExpress in Firefox or Chrome. Investigating the issue, he found two heavily obfuscated audio scripts embedded in Alibaba's security and anti-abuse tooling.

The scripts construct a WebAudio graph that generates a sawtooth waveform, passes it through the browser's audio system, and reads the resulting frequency data to create a device fingerprint. The audio gain is set to zero, so users hear nothing, but the processing still occurs. Callaghan noted this differs from an autoplaying video, as there is no media element for the browser's mute tab control to stop.

"In my case, that appears to have been enough for Firefox or Windows to keep the Bluetooth audio path active, preventing my multipoint headphones from switching cleanly back to the phone," Callaghan wrote. He also found code collecting screen dimensions, device memory, browser plugins, WebGL rendering, and mouse events—data that, together with the audio fingerprint, amounts to "a fairly comprehensive browser and device fingerprint."

Firefox responded, saying its anti-fingerprinting technology, introduced in version 118 (September 2023), thwarts such WebAudio-based tracking by grouping users into a small number of "buckets" based on hardware type. According to security engineer Tom Ritter, 99.24% of users fall into two main buckets: x86/x64 CPUs without FMA instructions, and x64 CPUs with FMA instructions. For the remaining 0.76%, the fingerprinting script fails entirely. However, 48 users worldwide fall into 23 other tiny buckets, making them uniquely identifiable—a limitation Firefox acknowledged as unfortunate.

The Register has sought comment from Alibaba. Callaghan reported being able to reproduce the issue reliably on both Firefox and Chrome.

Why This Matters

Privacy risk: Silent audio fingerprinting is a covert tracking technique that users cannot detect or block through normal means, potentially allowing companies to identify and profile visitors across sessions without consent.
Real-world impact: The technique interfered with a user's Bluetooth audio experience, demonstrating that such tracking can degrade device functionality without users understanding why.
Broader implications: This case highlights ongoing tensions between anti-fraud measures and user privacy, and the arms race between browser protections and fingerprinting techniques.

Background

Audio fingerprinting is a method of tracking users by exploiting subtle differences in how a browser or device processes sound—quirks arising from hardware, drivers, and software versions. Unlike cookies, fingerprints are difficult for users to clear or block. Browsers have been adding anti-fingerprinting features in recent years, but determined trackers often find new APIs to exploit. Alibaba operates several large e-commerce platforms, including AliExpress and Taobao, and uses custom security tooling to detect bots and abuse.

Key Perspectives

Matt Callaghan / Privacy advocates: Callaghan argues the hidden audio scripts amount to covert fingerprinting that undermines user choice. Privacy campaigners see this as another example of surveillance capitalism encroaching on basic browsing rights. Alibaba / Anti-fraud teams: Alibaba likely defends the tooling as necessary for detecting fraudulent activity, such as account takeovers or automated scraping, though it has not yet commented on this specific case. Firefox / Browser developers: Firefox counters that its anti-fingerprinting protections effectively group the vast majority of users, rendering audio fingerprinting useless. However, it concedes a tiny minority remain uniquely trackable—a flaw it says is an unfortunate but tolerable edge case.

What to Watch

Alibaba's response: Whether it confirms, denies, or modifies the audio fingerprinting scripts will signal how seriously it treats the privacy concerns.
Browser updates: Competitors like Chrome and Safari may introduce their own WebAudio protections or tighten existing ones in response to this revelation.
Regulatory scrutiny: European regulators under GDPR or other data protection regimes could investigate whether this practice constitutes a violation requiring user consent.

ZOTPAPER