AliExpress Caught Using Obsolete Audio Fingerprinting

Chinese e-commerce giant AliExpress has been identified using an obsolete audio fingerprinting technique, a method that analyzes inaudible sound waves generated by a visitor's browser. This discovery came accidentally when a researcher's Bluetooth headphones malfunctioned upon loading the AliExpress homepage, prompting an investigation into the site's tracking scripts.

The stealthy technique involves scripts that create an oscillator to measure WebAudio readings. While the gain is set to zero to prevent user detection, the browser processes the audio, and the resulting waveform provides a unique signature. This method was once effective due to variations in system libraries but has been largely mitigated.

Modern browsers have implemented defenses against this fingerprinting. Firefox, starting with version 118 released in 2023, utilizes its own unique math libraries, rendering the technique ineffective. Similarly, Chrome's use of internal libraries prevents this audio fingerprinting. Safari is also presumed to be protected, though confirmation is pending.

The continued use of this outdated method by AliExpress suggests it may be a leftover from previous tracking efforts, especially since the retailer employs more than a dozen other fingerprinting techniques. These include canvas rendering, WebGL information, screen dimensions, device memory, browser plugins, and event tracking.