AliExpress using outdated audio fingerprinting technique

Key facts

• AliExpress is employing an audio fingerprinting method that utilizes inaudible sounds sent to browsers.
• This technique was rendered ineffective in Firefox starting with version 118 due to the browser using its own math libraries.
• Chrome and likely Safari are also protected against this specific method.
• The online retailer utilizes numerous other fingerprinting techniques, including canvas rendering, WebGL information, and event tracking.

AliExpress has been identified as using an outdated audio fingerprinting technique, which involves sending inaudible sounds to browsers to create unique visitor signatures. This method, previously reliant on system-shipped math libraries, has been largely neutralized by browser developers.

Firefox addressed this vulnerability starting with version 118, released in 2023, by implementing its own math libraries. Tom Ritter, a Firefox developer also associated with the Tor Project, stated that this change reduced the entropy sufficiently to thwart the technique. Chrome is also unaffected because it utilizes its own proprietary libraries, according to a Google spokesperson. Safari users are presumed to be similarly protected, though Apple has not yet confirmed this.

The continued use of this obsolete method by AliExpress raises questions, especially given that the company employs over a dozen other fingerprinting techniques. These include canvas rendering, WebGL information, audio oscillator output, screen and viewport dimensions, device pixel ratio, hardware concurrency, browser plugins, supported audio/video formats, WebRTC behavior, browser performance timing, and tracking of user interactions like mouse and touch events, as well as device motion and orientation.

It is speculated that the web audio fingerprinting method is a leftover from previous practices that went unnoticed until now. While browser makers have taken steps to protect users from this specific technique, the efficacy of AliExpress's other data collection methods remains uncertain as website publishers continually seek new ways to bypass privacy protections.