5 ms·

I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days. Given that they don't (at least in my experience)

• emctech 2mo ago
  I wonder if it is something firefox and chrome devs need to look at because if it is accessing the audio device surely it should be notified to the user.
  • lxgr 2mo ago
    As I mentioned, I suspect that this is an active choice, as just displaying the icon whenever a media context exists seems much easier than inspecting the audio stream for non-zero volume media. I can only assume that there are legitimate reasons for this as well, e.g. websites preparing/maintaining audio context for lower latency when they intermittently play audio etc.
    • emctech 2mo ago
      Someone else mentioned that cloudflare uses the webaudio for verification challenge, but only triggers it briefly.
      • lxgr 2mo ago
        Ugh... Seems like we need an audio API web permission, or maybe do something like browser already do for some of the other APIs and actually require API users to actually play something or display a warning/play an annoying chime otherwise.
  • ajsnigrutin 2mo ago
    Not just notified but blocked by default. We already have similar bocks on autoplaying video (no audio until you interact) and access to microphones and cameras ("allow access.." popups). Every time an article like this comes out, people wonder about aliexpress instead of why their browser allows this in the first place.
• downrightmike 2mo ago
  I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue. @FireFoxDudes You need to be addressing fingerprinting
  • miki_oomiri 2mo ago
    How? How would a browser "know" what classifies as finger printing? Literally every piece of the engine is used for finger printing. It can be mitigated, a bit, but I don't see how browsers can win that battle. Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).
    • lxgr 2mo ago
      I feel like there are two levels of fingerprinting here, and a lot of the confusion is downstream of not properly distinguishing them: There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc. I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.
      • Bjartr 2mo ago
        I've only encountered the latter described as fingerprinting. Which makes sense side, like fingerprints, the information is being used to uniquely identify an individual. The former is traditional analytics and is not enough to uniquely identify an individual. Not all analytics are as privacy invasive as fingerprinting.
        • john_strinlai 2mo ago
          >The former is traditional analytics and is not enough to uniquely identify an individual shockingly little information is required to uniquely identify someone. "traditional analytics" (lets just say os + browser + some hardware info) is likely to be uniquely identifying when combined with just one other sparse dataset. >Not all analytics are as privacy invasive as fingerprinting. fingerprinting isn't a separate category of analytics. every data point can be (and often is) used for fingerprinting.
• ryandrake 2mo ago
  It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period. Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.
  • lxgr 2mo ago
    This issue is about audio output. Audio and video input are both behind per-site permissions.
    • pteraspidomorph 2mo ago
      Also, people can and should go to the firefox settings > Permissions and data > Autoplay and change the Default for all websites to "Block Audio" (at least). You can set per-hostname exceptions if you like! CTRL + I > Permissions
      • soulofmischief 2mo ago
        Unfortunately that still gives another data point for fingerprinting.
      • yjftsjthsd-h 2mo ago
        > You can set per-hostname exceptions if you like! CTRL + I > Permissions 1. Thank you, that's very nice to know about. 2. I really wish this was exposed more directly, probably from the permissions button that is already in the address bar. I can't believe Chrome does this better.
        • pteraspidomorph 2mo ago
          You can access page info through address bar shield > connection secure > more site information too. It used to be easier to access from there, but they redesigned that at some point I think.
  • 2mo ago
• nubinetwork 2mo ago
  It does on my Firefox, I had to close their tab because it also tricks kde into thinking I'm playing audio.
  • myself248 2mo ago
    Thaaaaaaat explains why an open Aliexpress tab always bumps my thermals ever so slightly.
    • HDBaseT 2mo ago
      What?
      • myself248 2mo ago
        CPU gets a little hotter, fan runs a little faster. Close the tab, it calms back down.
  • mozdeco 2mo ago
    The actual fingerprinting here does not work in Firefox though. A colleague of mine made a recent post here: https://ritter.vg/blog-webaudio_alibaba.html https://ritter.vg/blog-webaudio_alibaba.html
    • emctech 2mo ago
      While it may not be effective at fingerprinting, the side effect of the attempt sure is annoying when it stops my music! Do you know if it would count as a bug if muting the firefox tab or the browser as a whole does not stop the audio stream?
• pmontra 2mo ago
  The speaker icon would be handy but I think that it depends from both the good will of Firefox and the installed add ons. Of course if an add on blocks the audio file there is no need to display the speaker icon for that file. To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my Android phone. It shows a number of sites. Nothing in first party and these that I must fully enable to make the site work (css, image, script, xhr) * aliexpress.com * ase.aliexpress.com * it.aliexpress.com (my country two letters domain) * umdc-global.aliexpress.com * aidcgroup.net * ase.aidcgroup.net * 67372.ase.aidcgroup.net * alibaba-inc.com * epss.alibaba-inc.com * alicdn.com * ae01.alicdn.com * assets.alicdn.com * aliexpress-media.com * ae-pic-a1.aliexpress-media.com * assets.aliexpress-media.com * aliyun.com * acjs.aliyun.com Scary list, right? According to google aidcroup is > Alibaba International IPP Platform > https://ipp.aidcgroup.net https://ipp.aidcgroup.net > Alibaba International is committed to the protection of intellectual property rights. Right holders and their agents can enforce intellectual property ... Let me add a /s to the last line There are two more sites that I can completely block * googlesyndication.com * pagead2.googlesyndication.com so even Alibaba runs ads on Google. I did not instrument the browser like the author of the post did, so I don't know where the audio comes from. There is nothing listed in the media column of uMatrix. This does not mean that the post is inaccurate. It could be that the browser gets the audio stream from a request in one of the other categories. uBlockOrigin blocks two of other requests. 1. https://g.alicdn.com/code/npm/@ali/gmod-pop-disclosure-code/1.2.0/??index-pc.umd.css= https://g.alicdn.com/code/npm/@ali/gmod-pop-disclosure-code/... and this one that I anonymize 2. https://aplus.aliexpress.com/g.gif?logtype=0&title=WebPush https://aplus.aliexpress.com/g.gif?logtype=0&title=WebPush Permission&pre=https://it.aliexpress.com/?gatewayAdapt=glo2ita&scr=1920x1080&_p_url=https://it.aliexpress.com/wp.html&cna=<whatever cna is>&category=&aplus=&$${beacon_mini}$$=&yunid=&=&trid=<trid>&asid=<base64 stuff>$${get_sign}$$&p=1&o=linux&b=firefox153&s=1920x1080&w=gecko&ism=other&cache=<7 letters>&lver=8.15.25&jsver=aplus_std&pver=0.7.12&_pw=0&_ph=0&tag=1&stag=-1&lstag=-1&_slog=0 Probably the audio file is coming from one of the unblocked requests but my Debian laptop does not pair with my Bluetooth earpieces so I can't test it.
  • emctech 2mo ago
    It doesn't actually stream an audio file, the scripts generate audio at runtime using a sawtooth oscillator. It also only happens after several seconds.
• VladVladikoff 2mo ago
  Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.
  • emctech 2mo ago
    ebay does this i think, someone else linked a post about port scanning
  • bartread 2mo ago
    Yeah, that’s always an automatic nope. No explanation of who/what is really asking or why so, no: your shit software or website can’t go snooping around on whatever network I happen to be on, whether that’s at home or at work.
  • mohaine 2mo ago
    pretty sure it is a way of fingerprinting your machine/network
    • RajT88 2mo ago
      Let's hope it's as simple as that and not a malvertising campaign.
  • RajT88 2mo ago
    Chrome says "this site", no? Isn't it the tab you have in focus? I wonder what kind of person says 'Yes' to this prompt. It gives me the heebie jeebies.
    • auxiliarymoose 2mo ago
      3D mice and other hardware may run a local server for web applications to use them as input methods. The dialog can also show up if you are using network security software which proxies requests via private IP address range. Plenty of other non-nefarious reasons too... Safari and Firefox allow this by default without a prompt or visible indicator (but maybe that has changed now that Chrome added its dialog).
• stevecoalbear 2mo ago
  It should instead trigger a little germ icon, like a virus, because it's like a virus.
• michaelt 2mo ago
  > I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content When most sites do browser fingerprinting using audio, they use an 'OfflineAudioContext' - which unlike a normal AudioContext, doesn't run in real time and send its output to system's loudspeakers; instead, it runs faster-than-real-time and outputs to an AudioBuffer. So the browser can easily tell no sound is being played. For example - you can tell the browser to create a 10kHz square wave, feed it to a GainNode then a DynamicsCompressorNode, output to a buffer, then hash the contents of that buffer - which gives you a browser fingerprint, because of subtle differences between browsers.