TECHNOLOGY · VERIFIED DEVELOPMENT
AliExpress Caught Fingerprinting Visitors with Inaudible Sound Technique
WHY IT MATTERS
This technique raises concerns about user privacy and the potential for mass surveillance, as it allows websites to create unique identifiers without users' knowledge or consent.
What happened
Researchers discovered that Chinese retailer AliExpress has been using an outdated technique to fingerprint visitors. The method involves sending inaudible sounds to browsers, which are then measured to create a unique identifier.
This was uncovered by accident when a researcher's Bluetooth headphones stopped playing audio from his phone while loading the AliExpress homepage.
Further investigation revealed two highly obfuscated scripts that analyzed WebAudio readings to create a graph, effectively fingerprinting each visiting browser.
PRIMARY SOURCES
Inaudible sounds used to fingerprint browsers catch AliExpress red-handed
Ars Technica · Dan Goodin · Discovery only; Condé Nast copyright terms apply