Alibaba-owned online retailer AliExpress has allegedly been caught using hidden Web Audio processes to fingerprint users’ devices, according to privacy-focused browser Brave. Audio fingerprinting is a tracking technique that analyses tiny differences in how a device processes a sound to help identify it without relying on cookies.

The activity was discovered after a researcher noticed that multipoint Bluetooth headphones failed to switch audio properly while an AliExpress tab was open. Closing the tab restored normal behaviour, prompting an investigation that found the website running silent audio processes in the background.

According to the findings, AliExpress used the Web Audio API to generate a silent signal and analyse how it was processed by the device. Differences in CPUs, audio hardware, browsers and other software can produce subtle variations that contribute to a browser fingerprint, which is a combination of device characteristics used to recognise a user or device.

The scripts reportedly connected audio processing graphs to the system audio output at zero volume, meaning no sound could be heard. The resulting data was combined with other signals such as canvas rendering, WebGL and hardware information before being sent to Alibaba’s servers.

Brave said the scripts were part of the e-commerce platform’s anti-fraud and security tooling, but criticised the use of audio systems for tracking. “Alibaba’s AliExpress was caught using users’ audio systems to track them,” the browser said in a post on X.

Brave said it has blocked audio fingerprinting and other fingerprinting techniques by default for more than six years. It also said its protections specifically block the scripts used by AliExpress, requiring no changes to browser settings.

The browser noted that fingerprinting techniques continue to evolve and said it has recently added protections against GPU fingerprinting, which can similarly use graphics hardware and drivers to identify devices. It’s also worth mentioning that users on other browsers can also block the identified scripts with content blockers such as uBlock Origin, although this may affect AliExpress’ functionality.

(Source: Brave, via X / laserphile)

Updated 8:51 pm, Sun, 23 August 26