Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Browser fingerprinting can get creative at times, to say the least. eBay's WebSocket port scanner [1] and Reddit's abuse of DRM and JavaScript JIT exploits [2] from years ago are two examples of the kind of in-depth introspection you can perform completely in the background using nothing more than simple non-permission-gated APIs.by spicyjpeg
- Thanks for the readsby emctech
- Need to rethink the system that allows for (and encourages) this kind of plausible deniability. From "Oh we need this permission for [non essential feature] and you need to accept it if you want the app at all" -> to giving the user ultimate control over what happens on their personal device. Virtualize what the app can see and use fake data/identifiers/devices if necessary to get it to do what its supposed to. If the App isn't going to act in good faith why should the user? Fine grained permissions don't really work in practice because the app can keep annoying the user until they give in and hit Allow.by pyaamb
- What you want is basically how it works. On both phone platforms and PWAs, all permissions are visible to the user explicitly. All of them can be revoked at any time. Apps are disallowed from requesting an already-denied permission.
Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party software isn't under any obligation to work without them.
But the platforms have done what the platforms can do, at the architecture side, really. The next stage is human-audited enforcement of malware, which this AliExpress nonsense might hopefully run afoul of.
by ajross - Also perhaps AI agents are now capable enough to run these apps the way the user would and recognize these dark patterns. Flag those and feed it back to a warning at the point of sale that users can upvote there to signal their disapproval and a threshold score that risks removal of the app from the store. Because bad behaviour continues to make business sense if the rules allow it. Moreover, it penalizes and puts pressure on the good actors as a "missed business opportunity".by pyaamb
- A part of me is always smiling a little inside when people find creative ways to abuse browsers. It's always one more demonstration that the current web is fundamentally broken by design. The distinction between web browsers and random programs that allow remore arbitrary code execution is becoming more and more academic with every new feature that gets exposed to JavaScript.
Of course, I am also a horrible hypocrite and will actually use websites that use features like WebUSB or WebRTC.
by gmueckl - It was a mistake to normalize blindly executing whatever code the server sends your browser. One day we'll look back on this era and wish we had pulled the plug sooner.
- Concerning situation, I think. And I suspect (perhaps wrongly) that there are even more reasons for concern with technology that can track, capture, leak etc. information that's more sensitive or valuable, depending on how one wishes to look at it. Mobile phones, computers, routers etc. -- all have the potential to siphon out valuable information to a bad actor, especially when it comes to espionage, military, commercial etc. This has already happened at a significant scael, so it's not a remote scenario.
At the very least, governments and institutions should develop a framework to investigate all acquired technology. The community / civil society could also create something similar, a script that would analyse at a deep level everything that can be analysed with a piece of software even by a complete novice.
by robtherobber - Yes, I find it concerning too. I particularly dislike that windows was not aware, nor could it stop the audio stream from effecting the hardware. What other side channels like that exist? Perhaps I can be blamed for using windowsby emctech
- Recently I ran into a problem with my Bluetooth headphones. They support multipoint bluetooth audio, so they can be connected to my PC and phone at the same time. Opening the Aliexpress webpage causes a silent audio stream keeping the PC>headphone link active blocking my phone audio. An investigation reveals obfuscated code running device fingerprinting with a side effect being a silent audio stream that firefox, chrome and windows does not recognise but which kept the bluetooth connection active.by emctech
- Is this an AI summary of the article?
- Ah, so that's what Wolt (Doordash but in Europe) is doing.
I noticed that Voice Over (iOS screen reader) crackles and randomly changes volume when using the app, but I attributed it to standard iOS weirdness, and possibly misuse of some iOS API. Now I'm thinking that this may very well be fingerprinting.
by miki123211 - WebAudio fingerprinting is largely mitigated (in Firefox, potentially other browsers) - I wrote a quick overview that talks about the current distribution of values as well as our more recent efforts. https://ritter.vg/blog-webaudio_alibaba.htmlby tomrittervg
- Thanks for your input and perspective! Do you think it is a bug that the muting of the firefox tab doesn't stop the audio stream? It is frustrating that companies would use such an annoying tactic to track their users with it also ineffective.by emctech
- i'd argue that perhaps the ability to play audio should be permission gated, much like the ability to use webcam/microphone.
However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to.
With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing this, I'll be more willing to be bothered every time I want to play a video with audio to approve it if this bothers me.
by compsciphd - Firefox allows to Block "Audio and Video" (or "Only Audio") from auto playing per domain, including on Mobile.by throw101010
- The ability to play audio can usually be permission gated with tab muting, however the methods aliexpress use bypass that mechanism completely.by emctech
- I would actually love if I could have iOS prompt me to allow certain apps to use the speakers. I hate using an app and suddenly have a video autoplay loudly.by rcruzeiro
- So Apple will remove them from the App Store. Thats their whole argument for their closed system - they’ll protect users from malicious apps. Right?by forestry
- Report itby Cub3
- And maybe all the big airlines will learn geography 101.by brikym
- it's not the app that it's malicious, it's the websiteby agos
- I noticed in the last few weeks that if I’d recently opened the AliExpress iOS app (ie. it was backgrounded) my car audio would freak out thinking I was giving it an audio command. Killing the AliExpress app immediately fixed the problem. After seeing it happen more than once I assumed it was something dodgey and uninstalled the app.by patspam
- It's known that some Chinese mobile apps employ this trick to keep the app alive in the background, the rumor is that this way the 'active user' KPI can be better met.
edit: quantity qualifier
by ngl999 - And that's OK with Apple's App review?by hurfdurf
- I cannot ever imagine installing something like AliExpress as an app.by lukeify
- With my previous hearing aid I noticed that visiting a wide variety of web sites would cause a change in the amplification of environmental noise. I always assumed it was doing something with Bluetooth, and probably not for a good reason. This is with an iPhone 13 and one Kirkland/phonak hearing aid.
I haven’t noticed this recently, but I also now have two newer Phonak hearing aids and a few iOS updates have happened. Maybe the silent Bluetooth shenanigans are less disruptive to my new aids or the programming is different. Surely shenanigans continue.
by mgerdts - It seems far more likely that your cheap hearing aids are sensitive to certain RF frequencies and the background javascript is causing different patterns of load on the phone's CPU.
I would suspect that this only happens when you're charging and it is likely the charger or cable not being properly shielded.
by KennyBlanken - I wear Phonak CI processors. It's not just you. I've also experienced the volume drop on a few sites and apps. The Amazon iOS app does this. Each time I leave the app, ambient audio returns to normal.by jonathanlb
- I have the same on Android with my phonaks - not websites though, but both taking a photo and paying using Samsung pay appear to open an audio stream briefly, just long enough to jump into Bluetooth mode. It takes ~6 seconds to go back afterwards.
Quite frustrating as I'm often needing to hear the cashier at that point!