What if a website could identify your computer without using cookies, playing a sound, or asking you to install anything?
That is the privacy concern surrounding AliExpress after researchers discovered code on its homepage that appeared to use the browser’s audio system for fingerprinting. The technique, known as Web Audio fingerprinting, can analyze tiny differences in how a particular device processes an identical audio signal. Those differences can then become one piece of a broader digital fingerprint.
The discovery reportedly began with something far less dramatic: a pair of Bluetooth headphones that refused to behave normally.
Credits: Techspot
A Bluetooth Problem Reveals Something Strange
A developer noticed that multipoint Bluetooth headphones were not switching properly between a computer and a phone while an AliExpress tab was open. Once the tab was closed, the headphones began switching normally again.
That led the developer to inspect AliExpress’ website code and discover audio-processing activity running through the browser’s Web Audio API.
The unusual part was that the audio wasn’t being played for the user. The processing graph was configured at zero volume, meaning there was nothing audible coming from the page. Yet the browser was still processing the audio and connecting it to the computer’s audio system.
In other words, the website could be interacting with the audio hardware even when the user wasn’t listening to anything.
How Silent Audio Can Become a Fingerprint
Web Audio fingerprinting works on a surprisingly simple idea: two computers can process the same digital signal slightly differently.
Those differences can be influenced by a device’s processor, operating system, browser, drivers and audio hardware. By measuring the resulting output, a website can collect characteristics that help distinguish one device from another.
Think of it like asking millions of computers to perform the same tiny calculation. Their answers may look almost identical, but small variations can reveal that the calculations came from different machines.
Audio is only one possible ingredient. The reported AliExpress scripts also collected signals associated with Canvas rendering, WebGL, display settings, hardware configuration, WebRTC behavior and user interactions.
Individually, these signals may not reveal much. Combined, however, they can create a considerably more detailed picture of a browser and device.
Why Companies Want Fingerprints
Fingerprinting isn’t automatically malicious.
Online platforms use device and browser signals for legitimate security purposes, including fraud detection, bot prevention and suspicious-login detection. For example, if a transaction suddenly comes from a device with characteristics associated with unusual activity, additional security checks could be triggered.
The problem is that the same technology can potentially be used for tracking users without the visibility and control people expect from traditional cookies.
Unlike a cookie, which users can often see, delete or block, fingerprinting can happen largely behind the scenes.
Brave Pushes Back
Privacy-focused browser maker Brave was among the companies to highlight the AliExpress behavior. The browser said it blocks the scripts responsible for the reported audio-based tracking and has provided protections against audio fingerprinting for years.
Rather than allowing websites to receive perfectly consistent measurements, anti-fingerprinting technology can introduce controlled variations into certain browser outputs. This makes it harder for websites to create a stable identifier from the device.
Brave has also expanded its protections to other fingerprinting techniques, including GPU fingerprinting.
Credits: gHacks
The Bigger Privacy Battle
The AliExpress episode highlights a growing cat-and-mouse game between websites and browsers.
As cookies become less useful, companies have more incentive to find alternative ways of recognizing devices. And as browsers block those techniques, websites can look for new signals.
For users, the challenge is finding the balance between security and privacy. The same fingerprinting technology that can help stop fraud can also make it easier to recognize a device without the user’s knowledge.
The most striking part of this case may therefore be how little a user had to do for the technology to operate. No music had to play. No pop-up had to appear. No cookie necessarily had to be stored.
A completely silent browser process may have been enough to turn the computer’s own hardware into another tracking signal.
