Inaudible sounds used to fingerprint browsers catch AliExpress red-handed 不可听声音用于浏览器指纹识别，AliExpress被逮个正着

TL;DR

• AliExpress was found using an outdated audio oscillator fingerprinting technique that measures browser audio processing differences via inaudible sawtooth waves
• The technique was accidentally discovered by researcher Matthew Callaghan when it interfered with his multipoint Bluetooth headphones
• Firefox (version 118+) and Chrome have already patched this vulnerability by using constant math libraries instead of OS-provided ones
• AliExpress employs over a dozen other fingerprinting methods including canvas rendering, WebGL, WebRTC, and device motion tracking

Why It Matters

This case demonstrates how legacy tracking code persists on major e-commerce platforms long after browser vendors have neutralized specific techniques, highlighting the ongoing arms race between privacy protections and fingerprinting methods. It also shows that even obsolete techniques can still function on browsers that haven't implemented fixes, making it relevant for anyone concerned about web privacy or developing anti-fingerprinting tools.

Technical Details

• Audio oscillator technique: Two obfuscated scripts use the WebAudio API to generate a known sawtooth waveform at zero gain (inaudible), then measure how the browser's audio implementation alters the signal through an analyzer node, extracting frequency data that varies based on underlying math libraries
• Entropy source: Variability in OS-shipped math libraries combined with different CPUs historically produced unique signatures; Firefox countered this in version 118 (2023) by using its own constant math libraries, reducing entropy sufficiently to break the technique
• Additional fingerprinting metrics: Canvas rendering with toDataURL(), WebGL renderer/extensions/shader precision, screen/viewport dimensions, device pixel ratio, hardware concurrency, device memory, installed plugins, audio/video format support, WebRTC behavior, performance timing, mouse/touch/focus/scroll events, device motion/orientation, and browser automation detection properties
• Browser status: Chrome and Safari are likely unaffected due to shipping their own libraries; Firefox users on version 118+ are protected against this specific technique

Industry Insight

• Website operators relying on fingerprinting should audit their codebases for legacy techniques that may be ineffective on modern browsers while still collecting data, creating false confidence in tracking capabilities
• Browser vendors should continue proactive hardening of the WebAudio API and similar surfaces, as the AliExpress case shows that even deprecated techniques remain deployed at scale across the web
• Privacy researchers and practitioners should treat the AliExpress fingerprinting suite as a representative sample of industry-wide tracking practices, with thousands of sites likely employing similar multi-vector approaches

TL;DR

• AliExpress被发现使用过时的Web Audio指纹追踪技术，通过生成锯齿波分析浏览器音频处理差异来识别用户
• 研究者Matthew Callaghan偶然发现该技术，访问AliExpress时蓝牙耳机的手机音频会中断，关闭标签页后恢复
• Firefox 118（2023年）和Chrome已修复此漏洞，通过引入独立数学库降低熵值使该技术失效
• AliExpress同时使用十多种其他指纹追踪技术，包括Canvas、WebGL、屏幕尺寸、WebRTC行为等
• 浏览器厂商与网站追踪者之间存在持续的技术对抗，数千个网站可能采用类似追踪手段

为什么值得看

这篇文章揭示了主流电商平台仍在广泛使用已被浏览器修复的过时指纹追踪技术，提醒AI从业者和隐私保护者关注网站追踪手段的持续演变。对于浏览器开发者而言，这也凸显了持续对抗追踪技术的必要性，以及现有防护措施的实际覆盖范围。

技术解析

AliExpress使用的Web Audio指纹技术通过生成已知波形（锯齿波），测量音频经过浏览器音频实现后的结果，读取频率数据来创建唯一指纹。脚本将增益设为零以隐藏用户，但由于分析器仍连接到系统音频，浏览器继续处理并发送数据。

Firefox 118通过引入独立数学库替代操作系统默认库，显著降低熵值使该技术失效。Chrome和Safari也因类似原因不受影响。

AliExpress同时部署了Canvas渲染、WebGL信息、屏幕尺寸、设备像素比、硬件并发、已安装插件、WebRTC行为、浏览器性能计时、鼠标触摸事件、设备运动等多种指纹追踪技术。

行业启示

浏览器厂商需要持续对抗网站追踪者不断寻找的新突破方式，这是一场动态的技术竞赛，现有防护措施的覆盖范围需要定期评估。网站运营者应重新评估其追踪策略，避免使用已被标记的过时技术，同时关注用户隐私体验。隐私保护法规可能需要加强对指纹追踪技术的监管，推动行业向更透明的追踪方式转变。