222
AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
(blog.laserphile.com)
this post was submitted on 20 Aug 2026
222 points (99.1% liked)
Technology
87450 readers
3650 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
In a better world browsers would protect their users against shit like this.
Firefox tries but this is very hard to fight against. Most of the obvious holes were closed long ago. Now these fuckers use normal browser functionality that can't be disabled and record how it subtly differs (in various ways like execution time of functions) between different combinations of browsers, OSes, hardware, etc. This information alone is enough to create a more or less unique fingerprint.
The only reliable solution is to completely get rid of client-side code execution like JavaScript and WebAssembly and return to static web pages. Which of course won't happen.
Yeah, a lot of these fingerprinting capabilities seem like things that should be behind permission requests, if not outright disabled entirely.
Like ok, I get that if someone wanted to make a browser-based audio editing tool, it might be useful for javascript to be able to sample the output side after effects have been applied. But I don't want every single fucking website to have that capability by default. I'm not even sure I want websites to be able to play audio at all without permission.
By default, it should be a one way pipeline. Whatever they put into the pipeline gets displayed or played but they can't see any of the system-specific results. I'd prefer the standard be designing pages to work with any resolution instead of letting them query the exact pixel dimensions, which varies per device and I suspect fingerprinting was the reason they were designed like that in the first place.