Table of Contents
A developer worked out why his Bluetooth headphones kept dropping his music, and the answer was on the AliExpress homepage. The Register reported the story on Monday, drawing on the developer’s own account and a follow-up from a Firefox engineer.
Connor Jones, who wrote it up for The Register, records that the site has asked Alibaba to comment.
What Matt Callaghan noticed
Callaghan uses multipoint Bluetooth headphones, paired to a PC and a phone at once. He set out what happened in a blog post on 20 August.
“Usually I listen to music on my phone but with notifications or Youtube playing through the PC, this works reliably until I open an AliExpress page in Firefox or Chrome,” he wrote.
Audio from the phone stopped shortly after the homepage loaded. Closing the tab fixed it at once. Muting the tab, the browser or Windows did nothing, and no video or music was visible on the page.
What he checked first
Callaghan looked for hidden media. He checked for audio and video elements, calls to HTMLMediaElement.play(), active Media Session metadata, media requests and embedded frames.
None of it turned up anything. The playback state stayed at none. One clue stood out: the problem started only after the page had sat idle for several seconds.
What he found instead
He wrapped the AudioContext constructor to log whenever the page created an audio-processing context, and wrapped the connect method to see what reached the audio destination.
The homepage created two AudioContext objects. Both entered the running state. Both connected nodes to the audio destination, while the page still had no media elements, no play calls and no audible sound.
The stack traces named two scripts, collina.js and fireyejs.js, both served from an AWSC directory on an Alibaba media domain. Callaghan wrote that they “appear to be part of Alibaba’s browser security and anti-abuse tooling”.
The shape of the audio graph
Both scripts build the same chain, according to his write-up. A sawtooth oscillator feeds an analyser node, then a script processor, then a gain node set to zero, then the audio destination.
The oscillator makes a known waveform. The analyser measures what comes out the other side of the browser’s audio implementation. The gain sits at zero, so nothing is audible.
The graph still reaches the system audio destination, which makes the browser process it. “There is no media element for the browser’s normal tab mute control to stop,” Callaghan wrote. “As far as the page is concerned, it is performing live audio processing.”
What else the scripts measure
Callaghan lists canvas rendering, WebGL renderer information and shader precision, screen and viewport dimensions, device pixel ratio, hardware concurrency, device memory, installed plugins, supported media formats, WebRTC behaviour, performance timing, mouse, touch, focus and scroll events, device motion and orientation, and properties associated with browser automation.
He also describes code that serialises and encrypts results before sending them to Alibaba telemetry services. He calls the whole thing “a fairly comprehensive browser and device fingerprint”.
On what happens next he is explicit about the limit of what he can see. “I cannot see what AliExpress does with the resulting data after it reaches their servers.”
The Firefox engineer’s answer
Tom Ritter, who works on Firefox, published a follow-up the same day. His summary is that browser fingerprinting is pervasive, but that this particular method is not.
Firefox made its WebAudio output constant in version 118, released in September 2023, as part of its first round of fingerprinting protections. Ritter says 99.24% of users now land in one of three values, and 0.76% return a zero because the measurement fails.
The three values come down to processors. One covers x86 chips and x64 chips without fused multiply-add instructions, one covers x64 with them, and one covers ARM chips using NEON.
The 48 users
Ritter reports a long tail. Twenty-three further values belong to 48 users worldwide, which leaves each of them individually identifiable by this measurement.
“This is very unfortunate, as it makes these users completely unique, but it is also not terribly unusual,” he wrote. He puts the likely causes as bad memory, a CPU bug, or an unusual architecture.
His conclusion is blunt. “But at the end of the day, WebAudio fingerprinting is nearly useless.”
What the browser makers said
Firefox posted on X that its anti-fingerprinting technology handles this, and pointed to Ritter’s post. Brave also posted, saying it has protected users for six years.
“Brave injects random data into the browser’s output so you show a different fingerprint to different sites,” the company wrote. It says it also blocks the specific scripts by default.
Safari takes a third approach, injecting errors into an audio buffer rather than grouping users together. Ritter wrote that Chrome and Safari “probably have defenses against this”.
Where Chrome sits
The Register notes that Chrome does not aggressively protect users against fingerprinting, citing the privacy consultant Alexander Hanff earlier this year.
“There are at least thirty distinct fingerprinting techniques that work in Chrome right now, today, as you read this,” Hanff wrote. He described them as “real, production techniques deployed on millions of websites” rather than laboratory work.
Google is separately due to disable uBlock Origin and other Manifest V2 extensions in Chrome. Callaghan’s own fix is a pair of uBlock Origin filter rules blocking the two scripts.
What blocking costs
Callaghan reports that the homepage still renders with both scripts blocked, and that no audio contexts appear. Existing tabs have to be closed, because blocking a script does not shut down a context it has already created.
He adds a warning. Because the scripts appear tied to anti-fraud systems, blocking them “may cause extra CAPTCHAs or problems during login or checkout”.
Cloudflare has been working with Chrome, Firefox and Edge on an anti-bot protocol intended to separate people from automation without this kind of measurement.
The wider record
AliExpress was fined €550mn by the EU in July under the Digital Services Act. The desk covered that penalty at the time.
Apple’s Private Relay was found leaking IP addresses three ways this month, which the desk covered as a privacy failure. Comcast has begun turning home routers into motion detectors.
A Firefox bug ticket covering the audio behaviour has been open since before this. Callaghan linked to it in an update to his post.
If you liked the article, do not forget to share it with your friends. Follow us on Google News too, click on the star and choose us from your favorites.
If you want to read more like this article, you can visit our Technology category.