Inaudible sounds used to fingerprint browsers catch AliExpress red-handed
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A researcher discovered AliExpress was fingerprinting visitors' browsers using an audio-based technique: the site plays inaudible sawtooth waveforms through the WebAudio API, measures how each browser's audio implementation processes them, and uses the resulting fingerprint data for tracking. The researcher only noticed because the technique interfered with his Bluetooth multipoint headphones, cutting phone audio whenever the AliExpress tab was open. Two obfuscated scripts were found generating and analyzing the waveform via an oscillator with gain set to zero so users can't hear it, yet the browser still processes and transmits the fingerprint data.
Questions this post answers
How does audio-based browser fingerprinting using the WebAudio API actually work?
A script generates a known waveform, often a sawtooth wave, through an oscillator connected to the WebAudio API, sets the gain to zero so it's inaudible, then uses an analyser node to read how the browser's specific audio implementation processed that signal. Because audio hardware and software stacks vary slightly between devices and browsers, the resulting frequency data acts as a unique fingerprint sent back to the site. Developers auditing sites for covert tracking techniques can follow security research like this on daily.dev.
How was AliExpress caught fingerprinting visitors with inaudible sound?
A researcher named Matthew Callaghan noticed his Bluetooth multipoint headphones stopped playing phone audio every time he loaded the AliExpress homepage, and audio resumed once he closed the tab. Investigating the interference, he found two highly obfuscated scripts generating and analyzing inaudible sawtooth waveforms through the WebAudio API, which were being used to fingerprint his browser. Privacy-conscious developers track real-world tracking discoveries like this one on daily.dev.