AliExpress Caught Using Outdated Inaudible Sound Tracking Technique

The digital landscape continues to evolve, but some tracking methods used by online retailers remain stubbornly persistent. Recently, a researcher uncovered that AliExpress, a major Chinese e-commerce platform, has been employing an antiquated technique known as inaudible sound fingerprinting to track visitors' browsers. This revelation not only raises significant privacy concerns but also highlights the ongoing battle between user safety and data collection practices in the e-commerce sector.

Matthew Callaghan, the researcher who stumbled upon this issue, experienced a peculiar problem while using his Bluetooth headphones. Every time he opened the AliExpress homepage, audio from his phone ceased to play through the headphones, which are capable of connecting to multiple devices simultaneously. This unusual occurrence led him to investigate the underlying cause, ultimately revealing a sophisticated yet outdated tracking mechanism that uses inaudible sounds to identify and profile users.

The Mechanism Behind Inaudible Sound Tracking

At the heart of this tracking technique are two highly obfuscated scripts that generate inaudible audio signals, which the browser processes without any sound output for the user. The scripts create a graph that analyzes the WebAudio readings of the visiting browser, acting as an oscillator that measures Sawtooth waves—common outputs in digital audio processing.

How It Works

The oscillator generates a known waveform, while the analyzer measures the resulting frequency data after it has passed through the browser's audio implementation. By setting the gain to zero, these scripts ensure that users remain unaware of the inaudible sounds being played. Despite the lack of auditory feedback, the data collected through these methods allows AliExpress to build unique identifiers for each visiting browser.

Browser Responses and Evolving Privacy Measures

As this tracking technique became more widely known, browser developers began implementing measures to counteract such invasive practices. For instance, Mozilla Firefox introduced a fix in its version 118 released in 2023, opting for its unique math libraries instead of the operating system's default. This change reduced the entropy associated with audio fingerprinting, rendering the technique ineffective.

Other Browsers' Stance

Chrome, another dominant browser, employs its own libraries, making it less susceptible to the inaudible sound tracking. Although Apple’s Safari browser has not officially confirmed its defenses against this technique, it is likely that it also utilizes similar methods. This has raised questions about why AliExpress continues to use this outdated tracking approach, given the advancements in browser technology.

• Browser fingerprinting: A method of tracking users based on their device and browser configuration.
• Inaudible sound tracking: A technique that utilizes sound waves that are inaudible to the human ear to collect data.
• Entropy reduction: The process of minimizing the variability in data collection to enhance privacy.

AliExpress's Broader Tracking Practices

The continued use of this outdated technique by AliExpress raises concerns about the retailer's overall data collection practices. Callaghan noted that the company employs a variety of other fingerprinting methods, including:

• Canvas rendering and toDataURL()
• WebGL renderer information
• Extensions and shader precision
• Audio oscillator and analyzer output
• Screen and viewport dimensions
• Device pixel ratio and hardware concurrency
• Installed browser plugins
• Supported audio and video formats
• WebRTC behavior
• Browser performance timing
• Mouse, touch, focus, and scroll events
• Device motion and orientation properties

This extensive list of tracking techniques illustrates a broader trend in which e-commerce platforms seek to gather as much data as possible, often at the expense of user privacy. The existence of such tracking methods poses significant risks, not only to individual privacy but also to the perception of trustworthiness in online retail.

The Implications of Tracking on User Privacy

The revelation of AliExpress’s tracking methods underscores a critical conversation about online privacy and the ethical implications of user data collection. In an age where consumers are increasingly aware of their digital footprints, the persistence of such invasive techniques raises questions about corporate responsibility and user consent.

The Need for Consumer Awareness

As consumers navigate the online marketplace, it is essential for them to be informed about the various tracking methods employed by retailers. Understanding how their data is collected and used can empower users to make more informed decisions about their online interactions. Tools such as browser privacy settings, ad blockers, and VPNs can help mitigate unwanted tracking and enhance overall online security.

Key Takeaways

• AliExpress has been caught using an outdated inaudible sound tracking technique.
• Browser developers, such as Firefox and Chrome, have implemented measures to counteract such tracking methods.
• The retailer employs a range of other fingerprinting techniques to gather user data.
• Consumer awareness about data collection practices is crucial for protecting online privacy.
• Ongoing developments in browser technology are essential to maintaining user safety against invasive tracking.

Frequently Asked Questions

What is inaudible sound tracking?

Inaudible sound tracking is a fingerprinting technique that utilizes sound waves that are not audible to the human ear to gather data about users’ browsers and devices. This method can analyze WebAudio readings and create unique identifiers based on the sound output processed by the browser, allowing companies to track users without their knowledge.

How do browsers protect against tracking techniques?

Browsers like Firefox and Chrome have implemented their own libraries and unique algorithms to reduce the effectiveness of tracking methods like inaudible sound tracking. By minimizing variability in data collection and employing privacy-centric features, these browsers aim to enhance user safety and mitigate invasive tracking practices.

What are the implications of tracking on online privacy?

The continued use of invasive tracking techniques raises significant concerns regarding user privacy and corporate responsibility. As consumers become more aware of how their data is collected and used, there is a growing demand for transparency from companies and enhanced protective measures from browsers to safeguard personal information.

What can consumers do to protect their online privacy?

Consumers can take several steps to protect their online privacy, including using browser privacy settings, installing ad blockers, employing virtual private networks (VPNs), and being mindful of the data they share online. By staying informed and proactive, users can better navigate the digital landscape and reduce their risk of unwanted tracking.