What's Happening?
A developer discovered that AliExpress's website is using WebAudio to create unique browser fingerprints, even when no audible sound or media is present. This was identified after the developer experienced issues with multipoint Bluetooth headphones cutting
out when an AliExpress page was open. Investigation revealed that two scripts, 'collina.js' and 'fireyejs.js', served from an Alibaba media domain, were creating AudioContext objects. These objects generate a sawtooth oscillator, feed it through an analyzer node, a script processor, and a gain node set to zero, before reaching the audio destination. Although the gain is set to zero, making it inaudible, the process still engages the browser's audio system. This method allows AliExpress to collect extensive browser and device information, including canvas rendering, WebGL details, screen dimensions, hardware concurrency, installed plugins, and user interaction events, which are then serialized, encrypted, and sent to Alibaba telemetry services. This practice is described as a 'comprehensive browser and device fingerprint'.
Why It's Important?
This development highlights a significant privacy concern for U.S. internet users, as it demonstrates how websites can collect extensive data without explicit user consent or awareness. Browser fingerprinting, especially through methods like WebAudio, makes it difficult for users to remain anonymous online, even when using privacy-focused browser settings or ad blockers. The data collected can be used for targeted advertising, user tracking across different sites, and potentially for profiling individuals. While AliExpress claims these scripts are part of their anti-fraud systems, the lack of transparency about such data collection raises questions about data ethics and user control over personal information. This practice could lead to increased scrutiny from privacy advocates and potentially influence future data protection regulations in the U.S., similar to the EU's Digital Services Act, which recently fined AliExpress. Users may experience more CAPTCHAs or login issues if they attempt to block these scripts, indicating a trade-off between privacy and website functionality.
What's Next?
Browser developers are actively working on countermeasures to combat WebAudio fingerprinting. Firefox, for instance, has made its WebAudio output constant in newer versions to reduce its effectiveness for fingerprinting, and Brave browser injects random data to create different fingerprints for different sites. Chrome and Safari are also expected to have defenses against this technique. Users can implement their own solutions, such as using uBlock Origin filter rules to block the specific scripts, though this might lead to increased CAPTCHAs or issues during login or checkout processes on AliExpress. Cloudflare is also collaborating with major browser developers on an anti-bot protocol designed to differentiate human users from automation without relying on such invasive measurement techniques. The ongoing efforts by browser makers and privacy-focused organizations suggest a continuous arms race between websites seeking to collect data and technologies aiming to protect user privacy.
Beyond the Headlines
The use of WebAudio for browser fingerprinting by platforms like AliExpress underscores a broader trend in digital surveillance and data collection. This method exploits the technical capabilities of web browsers to create unique identifiers for users, moving beyond traditional cookies. The ethical implications are profound, as it blurs the lines between necessary security measures and intrusive data harvesting. It also highlights the challenge for regulatory bodies to keep pace with evolving tracking technologies. The 'invisibility' of this tracking—where no audible sound is produced—makes it particularly insidious, as users have no immediate indication that their device is being used for data collection. This situation could lead to a re-evaluation of what constitutes 'consent' in the digital age and push for more robust, default privacy protections in web browsers and operating systems. The incident also serves as a reminder of the complex interplay between user experience, website functionality, and personal privacy in the e-commerce landscape.
