{"id":744959,"date":"2026-08-24T18:05:19","date_gmt":"2026-08-24T15:05:19","guid":{"rendered":"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/"},"modified":"2026-08-24T18:05:19","modified_gmt":"2026-08-24T15:05:19","slug":"his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/","title":{"rendered":"His headphones kept cutting out, so he read the AliExpress code"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6af584e7c6d6e\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6af584e7c6d6e\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/#What_Matt_Callaghan_noticed\" >What Matt Callaghan noticed<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/#What_he_checked_first\" >What he checked first<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/#What_he_found_instead\" >What he found instead<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/#The_shape_of_the_audio_graph\" >The shape of the audio graph<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/#What_else_the_scripts_measure\" >What else the scripts measure<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/#The_Firefox_engineers_answer\" >The Firefox engineer\u2019s answer<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/#The_48_users\" >The 48 users<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/#What_the_browser_makers_said\" >What the browser makers said<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/#Where_Chrome_sits\" >Where Chrome sits<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/#What_blocking_costs\" >What blocking costs<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/buradabiliyorum.com\/en\/his-headphones-kept-cutting-out-so-he-read-the-aliexpress-code\/#The_wider_record\" >The wider record<\/a><\/li><\/ul><\/nav><\/div>\n<p><img decoding=\"async\" src=\"https:\/\/media.thenextweb.com\/2026\/07\/alibaba-t-head-sail-open-source-nvidia-cuda-alternative.avif\" \/><\/p>\n<div id=\"article-main-content\">\n<p>A developer worked out why his Bluetooth headphones kept dropping his music, and the answer was on the AliExpress homepage. <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.theregister.com\/security\/2026\/08\/24\/aliexpress-accused-of-fingerprinting-shoppers-with-silent-audio-trick-that-also-muted-a-devs-headphones\/5291662\" target=\"_blank\" rel=\"nofollow noopener\">The Register<\/a> reported the story on Monday, drawing on the developer\u2019s own account and a follow-up from a Firefox engineer.<\/p>\n<p>Connor Jones, who wrote it up for The Register, records that the site has asked Alibaba to comment.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_Matt_Callaghan_noticed\"><\/span>What Matt Callaghan noticed<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Callaghan uses multipoint Bluetooth headphones, paired to a PC and a phone at once. He set out what h<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>ened in <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/blog.laserphile.com\/2026\/08\/aliexpress-webpage-keeping-multipoint.html\" target=\"_blank\" rel=\"nofollow noopener\">a blog post<\/a> on 20 August.<\/p>\n<p>\u201cUsually I listen to music on my phone but with notifications or <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">Youtube<\/a> playing through the PC, this works reliably until I open an AliExpress page in Firefox or Chrome,\u201d he wrote.<\/p>\n<p>Audio from the phone stopped shortly after the homepage loaded. Closing the tab fixed it at once. Muting the tab, the browser or Windows did nothing, and no video or music was visible on the page.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_he_checked_first\"><\/span>What he checked first<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Callaghan looked for hidden media. He checked for audio and video elements, calls to HTMLMediaElement.play(), active Media Session metadata, media requests and embedded frames.<\/p>\n<p>None of it turned up anything. The playback state stayed at none. One clue stood out: the problem started only after the page had sat idle for several seconds.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_he_found_instead\"><\/span>What he found instead<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>He wrapped the AudioContext constructor to log whenever the page created an audio-processing context, and wrapped the connect method to see what reached the audio destination.<\/p>\n<p>The homepage created two AudioContext objects. Both entered the running state. Both connected nodes to the audio destination, while the page still had no media elements, no play calls and no audible sound.<\/p>\n<p>The stack traces named two scripts, collina.js and fireyejs.js, both served from an AWSC directory on an Alibaba media domain. Callaghan wrote that they \u201cappear to be part of Alibaba\u2019s browser security and anti-abuse tooling\u201d.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_shape_of_the_audio_graph\"><\/span>The shape of the audio graph<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Both scripts build the same chain, according to his write-up. A sawtooth oscillator feeds an analyser node, then a script processor, then a gain node set to zero, then the audio destination.<\/p>\n<p>The oscillator makes a known waveform. The analyser measures what comes out the other side of the browser\u2019s audio implementation. The gain sits at zero, so nothing is audible.<\/p>\n<p>The graph still reaches the system audio destination, which makes the browser process it. \u201cThere is no media element for the browser\u2019s normal tab mute control to stop,\u201d Callaghan wrote. \u201cAs far as the page is concerned, it is performing live audio processing.\u201d<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_else_the_scripts_measure\"><\/span>What else the scripts measure<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Callaghan lists canvas rendering, WebGL renderer information and shader precision, screen and viewport dimensions, device pixel ratio, hardware concurrency, device memory, installed plugins, supported media formats, WebRTC behaviour, performance timing, mouse, touch, focus and scroll events, device motion and orientation, and properties associated with browser automation.<\/p>\n<p>He also describes code that serialises and encrypts results before sending them to Alibaba telemetry services. He calls the whole thing \u201ca fairly comprehensive browser and device fingerprint\u201d.<\/p>\n<p>On what happens next he is explicit about the limit of what he can see. \u201cI cannot see what AliExpress does with the resulting data after it reaches their servers.\u201d<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_Firefox_engineers_answer\"><\/span>The Firefox engineer\u2019s answer<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Tom Ritter, who works on Firefox, published <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/ritter.vg\/blog-webaudio_alibaba.html\" target=\"_blank\" rel=\"nofollow noopener\">a follow-up<\/a> the same day. His summary is that browser fingerprinting is pervasive, but that this particular method is not.<\/p>\n<p>Firefox made its WebAudio output constant in version 118, released in September 2023, as part of its first round of fingerprinting protections. Ritter says 99.24% of users now land in one of three values, and 0.76% return a zero because the measurement fails.<\/p>\n<p>The three values come down to processors. One covers x86 chips and x64 chips without fused multiply-add instructions, one covers x64 with them, and one covers ARM chips using NEON.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_48_users\"><\/span>The 48 users<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Ritter reports a long tail. Twenty-three further values belong to 48 users worldwide, which leaves each of them individually identifiable by this measurement.<\/p>\n<p>\u201cThis is very unfortunate, as it makes these users completely unique, but it is also not terribly unusual,\u201d he wrote. He puts the likely causes as bad memory, a CPU bug, or an unusual architecture.<\/p>\n<p>His conclusion is blunt. \u201cBut at the end of the day, WebAudio fingerprinting is nearly useless.\u201d<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_the_browser_makers_said\"><\/span>What the browser makers said<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Firefox posted on X that its anti-fingerprinting <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" data-internallinksmanager029f6b8e52c=\"4\" title=\"Technology\" target=\"_blank\" rel=\"noopener\">technology<\/a> handles this, and pointed to Ritter\u2019s post. Brave also posted, saying it has protected users for six years.<\/p>\n<p>\u201cBrave injects random data into the browser\u2019s output so you show a different fingerprint to different sites,\u201d the company wrote. It says it also blocks the specific scripts by default.<\/p>\n<p>Safari takes a third approach, injecting errors into an audio buffer rather than grouping users together. Ritter wrote that Chrome and Safari \u201cprobably have defenses against this\u201d.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Where_Chrome_sits\"><\/span>Where Chrome sits<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The Register notes that Chrome does not aggressively protect users against fingerprinting, citing the privacy consultant Alexander Hanff earlier this year.<\/p>\n<p>\u201cThere are at least thirty distinct fingerprinting techniques that work in Chrome right now, today, as you read this,\u201d Hanff wrote. He described them as \u201creal, production techniques deployed on millions of websites\u201d rather than laboratory work.<\/p>\n<p>Google is separately due to disable uBlock Origin and other Manifest V2 extensions in Chrome. Callaghan\u2019s own fix is a pair of uBlock Origin filter rules blocking the two scripts.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_blocking_costs\"><\/span>What blocking costs<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Callaghan reports that the homepage still renders with both scripts blocked, and that no audio contexts appear. Existing tabs have to be closed, because blocking a script does not shut down a context it has already created.<\/p>\n<p>He adds a warning. Because the scripts appear tied to anti-fraud systems, blocking them \u201cmay cause extra CAPTCHAs or problems during login or checkout\u201d.<\/p>\n<p>Cloudflare has been working with Chrome, Firefox and Edge on an anti-bot protocol intended to separate people from automation without this kind of measurement.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_wider_record\"><\/span>The wider record<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>AliExpress was fined \u20ac550mn by the EU in July under the Digital Services Act. The desk covered that penalty at the time.<\/p>\n<p>Apple\u2019s Private Relay was found leaking IP addresses three ways this month, which the desk covered as a privacy failure. Comcast has begun turning home routers into motion detectors.<\/p>\n<p>A Firefox bug ticket covering the audio behaviour has been open since before this. Callaghan linked to it in an update to his post.<\/p>\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMN63nwsw68G3Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" target=\"_blank\" >Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/thenextweb.com\/news\/aliexpress-webaudio-fingerprinting-bluetooth-multipoint-collina-fireyejs\" target=\"_blank\" >Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A developer worked out why his Bluetooth headphones kept dropping his music, and the answer was on the AliExpress homepage. The Register reported the story on Monday, drawing on the developer\u2019s own account and a follow-up from a Firefox engineer. Connor Jones, who wrote it up for The Register, records that the site has asked&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-744959","post","type-post","status-publish","format-standard","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/744959","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=744959"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/744959\/revisions"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=744959"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=744959"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=744959"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}