AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

Original Article ↗ Hacker News Discussion ↗

AliExpress’s website was found to run obfuscated WebAudio code that generates a continuous silent audio stream, which both fingerprints users’ devices and hijacks Bluetooth audio focus, breaking multipoint headphones and other audio setups. Commenters see it as part of a broader pattern of aggressive tracking and misuse of browser and mobile APIs, raising questions about why such behavior isn’t gated by permissions the way camera and microphone access are. Many call for stronger browser-level protections, legal action under regimes like GDPR, and practical workarounds such as tighter ad‑blocking and disabling JavaScript on untrusted sites.

HN Thread Context & Meta

  • Original poster clarifies their top-level “summary” is actually an edited excerpt of the article; confusion stems from a Hacker News UI quirk where submission text becomes the first comment.
  • Several readers praise the technical write-up and say it triggered a useful broader conversation.

Technical Behavior: WebAudio Fingerprinting

  • Site runs obfuscated JavaScript using WebAudio to generate and analyze a known waveform.
  • Differences in the processed signal (sample rate, bandwidth, device pipeline quirks, Bluetooth profiles) feed into a fingerprint, alongside screen size, DPR, etc.
  • The script keeps an audio context and Bluetooth stream alive with inaudible output, bypassing normal tab-muting and sometimes not showing the “tab is playing audio” icon.
  • Some note modern browsers already try to normalize WebAudio outputs to reduce fingerprinting, but legacy or leftover code persists because it’s cheaper not to remove it.

User Impact & Anecdotes

  • Multiple reports of:
    • Bluetooth multipoint being “stuck” to PCs, blocking phones.
    • Car systems, soundbars, hearing aids, and AirPods suddenly switching mode or ducking ambient audio when visiting certain sites or apps.
    • Annoying pauses of Apple Music, Spotify, YouTube, or general audio focus theft.
    • Increased CPU usage, fan noise, and battery drain from background tabs.
  • Similar behavior is alleged on other shopping, payment, and social sites; some mention Cloudflare’s challenge uses WebAudio briefly (but not persistently).

Browser & OS Responsibilities

  • Many argue audio output should be permission-gated like mic/camera, or at least subject to stricter autoplay rules, with clear UI indicators when any audio stream is active.
  • Others counter that:
    • The web platform is already extremely fingerprintable; almost every API leaks bits.
    • Over-warning would cause user fatigue.
    • Fully “faking” or virtualizing permissions is technically hard and starts an endless arms race.

Mitigations Discussed

  • Custom uBlock Origin rules blocking specific AliExpress fingerprinting scripts are effective; some suggest upstreaming to major filter lists or EasyPrivacy/AdGuard.
  • Alternatives include:
    • Using strong content blockers (uBlock, AdGuard, Pi-hole).
    • Disabling or tightly gating JavaScript, accepting site breakage.
    • Adjusting autoplay/audio permissions per domain (especially in Firefox).
  • One Firefox engineer links a note describing WebAudio fingerprinting mitigations and engages on whether muted tabs should still hold an audio stream.

Privacy, Legality & Ethics

  • Many see this as invasive, battery-wasting abuse of non-permission-gated APIs.
  • Several call it potentially illegal under GDPR/cookie rules (fingerprinting without consent) or analogous to “exceeds authorized access.”
  • Skepticism that regulators or app stores will enforce rules consistently; some compare this to weak enforcement of privacy labels and wider patterns of digital surveillance.

Apps, E‑Commerce & Trust

  • Widespread distrust of shopping apps (AliExpress, Amazon, Temu, etc.): seen as deeply privacy-invasive and often pushing dark patterns, fake discounts, and app-only features.
  • Many prefer using mobile/desktop browsers with blockers, even at the cost of degraded UX and constant “install our app” nags.