Rendered at 07:09:47 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
lxgr 15 hours ago [-]
I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days.
Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content...
Now I wonder, does this also allow websites to continue running in the background on mobile browsers? Playing media is one of the very few things that can convince iOS Safari to keep a tab running indefinitely, in my experience.
VladVladikoff 14 hours ago [-]
Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.
announcer4614 10 hours ago [-]
Are you running PiHole, Adguard or similar and using macOS? On macOS, Chrome treats 0.0.0.0 as a local address which results in these prompts. Switching to having blocked domains return NXDOMAIN can work around the issue.
VladVladikoff 5 hours ago [-]
Thanks! Could be AdGuard!
derefr 7 hours ago [-]
I would note that if you say no to this, not only automatic but also explicit top-level navigation to “local network” locations (e.g. localhost, 192.168.1.x, etc) will be denied. Kind of annoying when you don’t want Chrome exploring your network, yet still need to regularly e.g. access your NAS web dashboard.
lxgr 12 hours ago [-]
Any chance it was a macOS prompt? Chrome needs local network permissions for WebRTC, Cast etc. even without any website accessing your local network.
mohaine 13 hours ago [-]
pretty sure it is a way of fingerprinting your machine/network
RajT88 12 hours ago [-]
Let's hope it's as simple as that and not a malvertising campaign.
javier2 8 hours ago [-]
usually its scanning for chromecasts on the local network, but could be other things as well
emctech 14 hours ago [-]
ebay does this i think, someone else linked a post about port scanning
RajT88 12 hours ago [-]
Chrome says "this site", no? Isn't it the tab you have in focus?
I wonder what kind of person says 'Yes' to this prompt. It gives me the heebie jeebies.
auxiliarymoose 6 hours ago [-]
3D mice and other hardware may run a local server for web applications to use them as input methods. The dialog can also show up if you are using network security software which proxies requests via private IP address range. Plenty of other non-nefarious reasons too...
Safari and Firefox allow this by default without a prompt or visible indicator (but maybe that has changed now that Chrome added its dialog).
VladVladikoff 5 hours ago [-]
No, it’s a macOS level prompt.
bartread 13 hours ago [-]
Yeah, that’s always an automatic nope. No explanation of who/what is really asking or why so, no: your shit software or website can’t go snooping around on whatever network I happen to be on, whether that’s at home or at work.
MattGrommes 12 hours ago [-]
Something in my work's SSO / auth mechanism does this and if you click No it silently screws up the internal website you're visiting. It doesn't block you from logging in, just parts of the site don't load/work. I haven't been able to get a good answer on what the heck is going on but it's extremely annoying.
RetpolineDrama 11 hours ago [-]
I had this and it turned out to be my unifi firewall block triggering a false-positive in the browser.
emctech 15 hours ago [-]
I wonder if it is something firefox and chrome devs need to look at because if it is accessing the audio device surely it should be notified to the user.
lxgr 15 hours ago [-]
As I mentioned, I suspect that this is an active choice, as just displaying the icon whenever a media context exists seems much easier than inspecting the audio stream for non-zero volume media.
I can only assume that there are legitimate reasons for this as well, e.g. websites preparing/maintaining audio context for lower latency when they intermittently play audio etc.
emctech 15 hours ago [-]
Someone else mentioned that cloudflare uses the webaudio for verification challenge, but only triggers it briefly.
lxgr 15 hours ago [-]
Ugh... Seems like we need an audio API web permission, or maybe do something like browser already do for some of the other APIs and actually require API users to actually play something or display a warning/play an annoying chime otherwise.
ajsnigrutin 11 hours ago [-]
Not just notified but blocked by default. We already have similar bocks on autoplaying video (no audio until you interact) and access to microphones and cameras ("allow access.." popups).
Every time an article like this comes out, people wonder about aliexpress instead of why their browser allows this in the first place.
nubinetwork 15 hours ago [-]
It does on my Firefox, I had to close their tab because it also tricks kde into thinking I'm playing audio.
myself248 14 hours ago [-]
Thaaaaaaat explains why an open Aliexpress tab always bumps my thermals ever so slightly.
HDBaseT 8 hours ago [-]
What?
myself248 6 hours ago [-]
CPU gets a little hotter, fan runs a little faster. Close the tab, it calms back down.
ryandrake 15 hours ago [-]
It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period.
Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.
dylan604 13 hours ago [-]
I do not have the Zoom app in any form installed. I'd much rather use it in the browser. When I close the tab, Zoom is gone. After the COVID era bullshit of Zoom installing a utility that gives root access to anything, I've never installed it. Luckily, all of that came out before I started using Zoom.
mywittyname 11 hours ago [-]
There's a solution to both:
1. Not make web browser general-purpose runtimes for arbitrary software.
2. OS builds a general-purposes runtime that's completely sandboxed. So users can run more complex software without needing to worry about cruft being installed on their system.
Unfortunately, browser builders have decided that web browsers are #2.
Rohansi 5 hours ago [-]
What is the practical difference if the OS provides your general-purpose sandboxed runtime instead of the browser? The browser is already a product being developed by the same organization as the OS for a significant chunk of people.
iOS -> Safari
Android -> Chrome
Windows -> Edge (based on Chromium, so fixes in Edge make their way into Chrome too)
pxoe 9 hours ago [-]
They don't "just hand over access". If anything, browsers pioneered permissions for mic and camera on desktops, having them several years earlier before windows even got around to having these things restricted under permissions.
lxgr 15 hours ago [-]
This issue is about audio output. Audio and video input are both behind per-site permissions.
pteraspidomorph 15 hours ago [-]
Also, people can and should go to the firefox settings > Permissions and data > Autoplay and change the Default for all websites to "Block Audio" (at least).
You can set per-hostname exceptions if you like! CTRL + I > Permissions
yjftsjthsd-h 12 hours ago [-]
> You can set per-hostname exceptions if you like! CTRL + I > Permissions
1. Thank you, that's very nice to know about.
2. I really wish this was exposed more directly, probably from the permissions button that is already in the address bar. I can't believe Chrome does this better.
soulofmischief 13 hours ago [-]
Unfortunately that still gives another data point for fingerprinting.
stevecoalbear 13 hours ago [-]
It should instead trigger a little germ icon, like a virus, because it's like a virus.
pmontra 15 hours ago [-]
The speaker icon would be handy but I think that it depends from both the good will of Firefox and the installed add ons. Of course if an add on blocks the audio file there is no need to display the speaker icon for that file.
To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my Android phone. It shows a number of sites. Nothing in first party and these that I must fully enable to make the site work (css, image, script, xhr)
* aliexpress.com
* ase.aliexpress.com
* it.aliexpress.com (my country two letters domain)
* umdc-global.aliexpress.com
* aidcgroup.net
* ase.aidcgroup.net
* 67372.ase.aidcgroup.net
* alibaba-inc.com
* epss.alibaba-inc.com
* alicdn.com
* ae01.alicdn.com
* assets.alicdn.com
* aliexpress-media.com
* ae-pic-a1.aliexpress-media.com
* assets.aliexpress-media.com
* aliyun.com
* acjs.aliyun.com
Scary list, right? According to google aidcroup is
> Alibaba International is committed to the protection of intellectual property rights. Right holders and their agents can enforce intellectual property ...
Let me add a /s to the last line
There are two more sites that I can completely block
* googlesyndication.com
* pagead2.googlesyndication.com
so even Alibaba runs ads on Google.
I did not instrument the browser like the author of the post did, so I don't know where the audio comes from. There is nothing listed in the media column of uMatrix. This does not mean that the post is inaccurate. It could be that the browser gets the audio stream from a request in one of the other categories.
Probably the audio file is coming from one of the unblocked requests but my Debian laptop does not pair with my Bluetooth earpieces so I can't test it.
emctech 14 hours ago [-]
It doesn't actually stream an audio file, the scripts generate audio at runtime using a sawtooth oscillator. It also only happens after several seconds.
pmontra 14 hours ago [-]
Thanks. So one of the downloaded scripts is generating the audio and the browser should detect it.
downrightmike 15 hours ago [-]
I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue.
@FireFoxDudes You need to be addressing fingerprinting
miki_oomiri 15 hours ago [-]
How? How would a browser "know" what classifies as finger printing? Literally every piece of the engine is used for finger printing.
It can be mitigated, a bit, but I don't see how browsers can win that battle.
Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).
lxgr 15 hours ago [-]
I feel like there are two levels of fingerprinting here, and a lot of the confusion is downstream of not properly distinguishing them:
There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc.
I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.
Bjartr 14 hours ago [-]
I've only encountered the latter described as fingerprinting. Which makes sense side, like fingerprints, the information is being used to uniquely identify an individual.
The former is traditional analytics and is not enough to uniquely identify an individual.
Not all analytics are as privacy invasive as fingerprinting.
john_strinlai 12 hours ago [-]
>The former is traditional analytics and is not enough to uniquely identify an individual
shockingly little information is required to uniquely identify someone.
"traditional analytics" (lets just say os + browser + some hardware info) is likely to be uniquely identifying when combined with just one other sparse dataset.
>Not all analytics are as privacy invasive as fingerprinting.
fingerprinting isn't a separate category of analytics. every data point can be (and often is) used for fingerprinting.
bigbuppo 15 hours ago [-]
Just assume any site using javascript is using it for nefarious purposes.
john_strinlai 12 hours ago [-]
a lot of what is used for fingerprinting is also used legitimately, and a lot of sites fingerprint. so ~every site would be behind a security risk warning.
we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored
FuckButtons 11 hours ago [-]
Presumably the intended outcome would be that sites would be pressured into not being malignant actors with regards to user privacy, rather than everyone just ignoring the security notice.
john_strinlai 10 hours ago [-]
i understand the intention, and i offered my opinion on what the actual outcome would be.
~every piece of data can be used for fingerprinting. settings and preferences, browser, os, etc. fingerprinting is not its own category of data, it's the correlation of regular data.
the "pressure" ends up being: stop receiving any data at all (which would obviously break ~everything), or put up a warning (leading to fatigue).
consider accessibility settings: absolutely required for some people to browse the internet, but also extremely high-value data for fingerprinting a user.
there is no technical method to know whether a site asking about a visitor's accessibility settings is doing it so that they can properly display content or so that they can fingerprint the visitor. (i.e. there is no "evil bit")
sebastiennight 5 hours ago [-]
> there is no "evil bit"
There's always been one, but it's been defaulting to 1 ever since the Web 2.0 upgrade, and the API to set it back to 0 has been deprecated.
emctech 6 hours ago [-]
I touched on this in my article, once the data has been collected and sent to their servers you have no idea what they do with the information. At least with GDPR it is supposed to be regulated but obviously that is not the case everywhere and websites can still lie.
numpad0 11 hours ago [-]
Or just started removing features and debloating the Web standards. We don't need WebCoffeeBeansRoasterGrinder or WebElectricVehicleEmergencyBraking. We should be able to live with a LOT less without graphics, performance, or addictiveness degradation.
mgerdts 18 hours ago [-]
With my previous hearing aid I noticed that visiting a wide variety of web sites would cause a change in the amplification of environmental noise. I always assumed it was doing something with Bluetooth, and probably not for a good reason. This is with an iPhone 13 and one Kirkland/phonak hearing aid.
I haven’t noticed this recently, but I also now have two newer Phonak hearing aids and a few iOS updates have happened. Maybe the silent Bluetooth shenanigans are less disruptive to my new aids or the programming is different. Surely shenanigans continue.
retrac 14 hours ago [-]
It's the Bluetooth; when Bluetooth connects most hearing aids reduce the environmental volume slightly so you can hear the streaming content. Some app has started to play audio (perhaps silently). I notice it on some websites.
How much HAs reduce environmental sounds when streaming is configurable by the way, but only by the audiologist if you don't have your own programmer. I don't like the effect and prefer to just turn down the volume manually.
mgerdts 12 hours ago [-]
Is this tunable per hearing program? When in an even moderately noisy environment I find myself switching to AirPods if I’m streaming. I would love for the HA to give separate controls for BT audio vs ambient like AirPods do.
12 hours ago [-]
montymintypie 6 hours ago [-]
I have the same on Android with my phonaks - not websites though, but both taking a photo and paying using Samsung pay appear to open an audio stream briefly, just long enough to jump into Bluetooth mode. It takes ~6 seconds to go back afterwards.
Quite frustrating as I'm often needing to hear the cashier at that point!
jonathanlb 15 hours ago [-]
I wear Phonak CI processors. It's not just you. I've also experienced the volume drop on a few sites and apps. The Amazon iOS app does this. Each time I leave the app, ambient audio returns to normal.
phoghed 15 hours ago [-]
They’re kindly turning down the background noise so you can focus on shopping and buying more stuff.
lenerdenator 14 hours ago [-]
It'd be interesting to see what a lawyer specializing in disability law would think of that.
At least in the US, I could see that being something that the ADA prohibits.
BoorishBears 13 hours ago [-]
I noticed my MBP had a periodic stutter sometimes: every 3 seconds or so the mouse would lock up for a few milliseconds.
I tracked it down to American Express's login page (auto loads if you leave the site idle) relying on Akamai's anti bot measures polling some web Bluetooth feature, causing Chrome to trigger a BT scan: https://castle.io/research/fingerprint-harvesting-in-the-bot...
Turning off Bluetooth solves it, but that's not a great solution when using a Bluetooth mouse... and it sounds like it might be causing your issue too.
KennyBlanken 15 hours ago [-]
It seems far more likely that your cheap hearing aids are sensitive to certain RF frequencies and the background javascript is causing different patterns of load on the phone's CPU.
I would suspect that this only happens when you're charging and it is likely the charger or cable not being properly shielded.
mgerdts 14 hours ago [-]
The cheap hearing aid cost $750 for one and is substantially the same as the same thing sold from standalone audiologists for much more. These are not cheap over the counter devices.
Charging only happens while in the cradle, not while worn.
14 hours ago [-]
kevin_thibedeau 11 hours ago [-]
Audio is being generated and the BT device is prioritizing it by changing its internal mixer settings. Same as audio prompts over music in a car. This could be mitigated by detecting silence in the audio stream but this is anti-consumer behavior that needlessly drains batteries with excess transceiver activity.
rrr_oh_man 12 hours ago [-]
> cheap hearing aids
I don't think you know what you are talking about
patspam 20 hours ago [-]
I noticed in the last few weeks that if I’d recently opened the AliExpress iOS app (ie. it was backgrounded) my car audio would freak out thinking I was giving it an audio command. Killing the AliExpress app immediately fixed the problem. After seeing it happen more than once I assumed it was something dodgey and uninstalled the app.
lukeify 20 hours ago [-]
I cannot ever imagine installing something like AliExpress as an app.
ivanjermakov 18 hours ago [-]
Not sure if they still do, but a couple years ago prices in the app were lower than on the website. And they promoted installing it to save money.
wongarsu 17 hours ago [-]
I believe the prices are the same. But the app has a number of "games" to collect tokens that get credited as discounts. Seems to be mostly stuff designed to get you to open the app daily and browse their offers. Which might be "innocent" if it's just to get you to buy more stuff, or maybe they have more reasons they want you to have the app open. Who knows
At least Aliexpress doesn't have all the fake slot machine type games that temu has that always end in variations of "get $200 of discounts for your next order if you order x items from this list"
ornornor 16 hours ago [-]
There are few things more scammy than AliExpress “discounts”. I have yet to see a cent of the hundreds of dollars of “savings” they gave or advertised to me.
phoghed 15 hours ago [-]
Very true, I almost never use Ali Express because I have no clue what anything is going to cost until I get to roughly the final step of checking out.
farlight 11 hours ago [-]
They used to give 5-10 bucks of credit to new users a few years ago. Real credits, I very carefully compared prices from different IPs.
So I would register a new account for each order -- 10 USD is quite a lot of money in my country -- and saved at least a hundred on buying dev boards and other components.
tgsovlerkhgsel 11 hours ago [-]
That's how you know you absolutely should not do that.
Like a white van with FREE CANDY written on it...
ihaveajob 10 hours ago [-]
It worked for Reddit... It used to be a 100% website experience and now I'd venture the majority of their traffic is from the mobile app.
ahofmann 17 hours ago [-]
Now we know why...
coldtea 17 hours ago [-]
And someone would install random apps to save $5 on $100 purchases?
fckgw 16 hours ago [-]
"random apps" and it's the largest eCommerce company on the planet
coldtea 11 hours ago [-]
So what? I install 0 ecommerce mobile apps.
What, I suddenly need to buy Alibaba crap and I can't wait to get to a laptop browser?
HDBaseT 8 hours ago [-]
You've moved the goal posts there.
"Why would anyone install a random app"
"Why would anyone use a phone to make a purchase"
--
Globally, more than half of all eCommerce purchases are made on a phone or tablet.
imzadi 16 hours ago [-]
When I did customer tech support for a major retailer, we had confused customers calling all the time because they would randomly get price-match refunds they never asked for. They were installing apps that were automatically requesting the refunds by searching their emails for orders and checking the prices on the websites. These people had no idea they had even given these apps permission to read their emails.
ivanjermakov 17 hours ago [-]
You'd be surprised on what general public can go to save $5.
vlachen 17 hours ago [-]
I mean, I'm haunted by the things I did for a Klondike Bar.
farlight 10 hours ago [-]
Sure. I can live for a day on those five bucks. You wouldn't believe what people in low income countries go through to save a bit of money: I've seen people I know (but couldn't stop in time) send copies of their ID to some shady company to get a five percent discount on gasoline.
17 hours ago [-]
account42 16 hours ago [-]
eBay keeps pushing their app with a $5 discount, advertised using a focus-stealing popup interrupting your attempt to give them money, so some people must be taking the bait.
imzadi 17 hours ago [-]
They also don't give you a proper tracking number. The only way to track your shipment is in the app.
jhoechtl 16 hours ago [-]
This is not correct. I do not have the app and get tracking for my orders.
imzadi 16 hours ago [-]
I get email updates but whenever I click the track link it tells me I need the app.
ssl-3 15 hours ago [-]
I have a package on the way with AliExpress. It is headed from somewhere in China to somewhere in the US.
Using my computer just now, I looked at one of the emails that AliExpress sent about this order. It had a clickable tracking number displayed; I clicked it.
That brought me to their website, where I landed on a page that included the last update for my order and also a link to "View Details".
That works for me. It was very easy to where along the line my stuff is (and that it is not in the US yet).
---
Meanwhile: I also copied the tracking number from the email. I pasted that tracking number into the box at usps.com.
The USPS knows of my tracking number and they do not have my item yet. Fair enough.
I ticked some boxes and told them to send me updates, which I'm sure they'll do once they have updates to send -- just as they have done for ~decades now.
This also works for me.
KennyBlanken 15 hours ago [-]
Many sites will work fine in a desktop browser but refuse to do anything in a mobile browser, demanding you install their app or just immediately redirecting you to the iOS or Android app store.
MobiusHorizons 16 hours ago [-]
It does show a popup to that effect, but if you dismiss it you can still see the tracking info. Definitely annoying, but not unworkable.
tjoff 16 hours ago [-]
If on mobile, ticking "desktop mode" in your browser usually goes around that dark pattern.
wongarsu 15 hours ago [-]
Depends on the shipping company, and likely on your location. I get tracking numbers for most but not all shipments
chpatrick 13 hours ago [-]
You just have to press the right link on the site and you get the tracking page (despite saying you need the app).
MallocVoidstar 17 hours ago [-]
It's still the case that you pay less in the app. You get 'coins' for a daily check-in, which are automatically(?) applied as a discount. Most items either don't actually use them or only give you a pointless 1% off or something, but I've gotten a $12 microcontroller for $5, for example. I think some coupons are app-only, too (though most aliexpress sales are fake and are better thought of as the normal price).
lenerdenator 14 hours ago [-]
You pay less money in the app.
Companies are not going to hire a mobile dev team to create an app to give you a way to pay them less for a good.
They hire a mobile dev team to create an app to give you a way to hand over data that you otherwise wouldn't, is technically impossible to do through a web browser, and is worth more than the discount that they give you for using the app.
stackghost 16 hours ago [-]
>You get 'coins' for a daily check-in, which are automatically(?) applied as a discount.
This should be illegal
rigrassm 18 hours ago [-]
> Not sure if they still do, but a couple years ago prices in app were lower than on the website. And they promoted installing it to save money.
Translation: They are able to mine your personal data more completely with an app installed vs the website which they can sell for pure profit. They promoted installing it to extract more value from you.
swores 17 hours ago [-]
That's definitely a feasible explanation (and the one I would assume to be true for AliExpress).
But there is another, slightly less evil, explanation that I know at least some companies have pushed their apps because of: the thinking is that if you're on their website, there is less friction to open a new tab and search for a lower price from their competitors, than if you're in their app. Obviously it's hardly any different - opening a new app (the web browser) vs. opening a new tab in the app you're already in - but the theory is that there's a slight psychological difference.
Of course I'm not saying that trying to prevent your customers from searching for better deals is a nice thing to do. Just adding that data mining isn't the only reason for some companies to want people to use their apps.
flkiwi 14 hours ago [-]
It's quickly getting to the point for me that "find the thing I want locally and buy online if it's cheaper" is reversing. I've actually been to one of the few remaining electronics retailers to look for a PC for my kid recently, and it was nice not to be assailed by dark patterns (yes, there are dark patterns in b&m retail, but they're much more obvious).
WarmWash 16 hours ago [-]
It also all goes to the party, who are the owners of Alibaba (and every other company in China).
Should you ever need someone in a foreign country to do something for you, it's good to have as much information as possible at your disposal about them.
BatteryMountain 16 hours ago [-]
Absolutely crazy the amount of dodgy apps people install and giving permissions to read the system when asked...
GJim 15 hours ago [-]
Yesterday on here, somebody was demo'ing a sun clock website that asks for your position.......
....and yes, many HN'ers were clearly happy to give there precise GNSS coordinates to some random scrote who askes for them.
unixhero 20 hours ago [-]
It's great for shopping. But in the US you have amazon prime. We don't.
dogman1050 19 hours ago [-]
I have Prime, but I can't imagine installing the Amazon app either. The website works just fine.
nntwozz 19 hours ago [-]
This is the way. It's prudent to treat apps with skepticism, it's unfortunate it's come to this.
I study Apple's Privacy Nutrition Labels religiously every time I consider installing an app.
I like the ones with "Data Not Collected".
woadwarrior01 18 hours ago [-]
I'm an app developer and all my apps have the "Data Not Collected" privacy nutrition label. I love the idea, but Apple's enforcement of it is very lackadaisical. I've reported dozens of apps that were blatantly lying on their privacy nutrition labels to Apple and I'm yet to see any such app's nutrition label change.
I can't help but feel the whole Apple privacy PR will be blown in the future where some report will come out that Apple has been logging and sharing user data with NSA since 2001.
voakbasda 17 hours ago [-]
Why have rules (or laws) if they don’t enforce them? Or only enforce them selectively when they feel it necessary, such as when not doing so would threaten your stock price (or re-election campaign)? Maybe I just answered my own question?
Reminds me of meat processing regulations. I can sell my animals whole to buyers through a custom processing exemption, but they must go pick up their meat from the butcher. The law says I cannot pick up and deliver it, but it is trivial to find people advertising that extra service. Reporting them does not result in any obvious action.
In both of our cases, our honesty is a liability in the marketplace, because people are ignorant of such laws (or simply don’t care). Really, they simply want the product that they want, as conveniently as possible. We are then forced to compete in the marketplace with liars and cheats.
I am sure our peers here can find countless examples in other areas where this flavor of dishonesty prevails. Hell, I would love to hear some counter examples, because I cannot help but view this state of affairs as intentional at this point.
The purpose of system is what it does (or, in this case, does not do).
otherjason 17 hours ago [-]
The cynical way to look at this is that the purpose of the system (the privacy nutrition label) is to support Apple's carefully-crafted and -marketed image as the most privacy-focused of the tech giants. Actually having enforcement of the contents of said labels would be a nice potential byproduct of that, but that's not strictly required to accomplish the system's purpose.
manbash 18 hours ago [-]
With Firefox, yes.
I wouldn't fully trust other browsers to care about my privacy.
AstralSerenity 18 hours ago [-]
Using web apps on Firefox really is the way given its support for uBlock Origin.
Screen real estate is precious on phones, so being able to permanently block "Install our app!" and even entire navigation categories (shorts on LinkedIn) is quite valuable.
Then you can "install" the site on your home screen or simply place it in collection folders so it's sitting ready on your "New Tab" page.
threecheese 14 hours ago [-]
I uninstalled the app recently; despite having layers of ad tracking protection, I would see my Amazon searches appearing in my social media feed in near real time, and this irked me.
I dropped their .com into a Home Screen icon, and this completely stopped (at least as far as I’ve observed). It’s definitely more janky from an experience perspective, but still easier than driving to the store.
ianburrell 13 hours ago [-]
Shopping works better on web sites because can open multiple tabs to browse multiple products. Especially important on big stores like Aliexpress and Amazon where need to compare lots of products. Desktop is better for that but mobile browsers are still better than apps.
HPsquared 18 hours ago [-]
I think you need the app to use the delivery lockers (which I prefer over home delivery)
boobsbr 18 hours ago [-]
AFAIK, the app is just the website in a webview.
fragmede 20 hours ago [-]
Where is "we"?
ngl999 19 hours ago [-]
Likely the place where people are "willing to trade privacy for convenience", according to Baidu's CEO.
stinos 16 hours ago [-]
I always wonder if it's worth it. Like: is it actually convenient, or is it 'solving' inconveniences which actually do not exist or didn't exist before using the service? I have never used Prime or AliExpress but also don't consider our typical shopping very inconvenient. And the most inconvenient parts are actually the ones which seem necessary to to get the proper goods (from past weeks: vegetables/fruits/shoes - it's not really possible to order that online and get exactly what we want). And everything else is available from other webshops.
rcruzeiro 19 hours ago [-]
According to their profile: Norway
embedding-shape 19 hours ago [-]
I don't have Amazon Prime (nor am I in the US) yet use Aliexpress perfectly fine on my mobile phone without using an app. Frankly, I don't understand how the two is related at all?
doubled112 19 hours ago [-]
AliExpress won't allow me to open most pages in the account section on my iPhone. Instead I get a page telling me to install the app.
While browsing, there are also popups offering the app approximately every third link I click. Some of them are telling me to install the app.
Unless the situation has changed recently, it's not perfectly fine, it is unusable on purpose.
emctech 19 hours ago [-]
AE website on mobile is terrible, they basically force you to use the app. I exclusively use the website on my PC
whstl 19 hours ago [-]
So they're pulling a Reddit, basically.
"The app is great because the website is heavily degraded".
deepsun 15 hours ago [-]
Reddit is fine, just a small popup at the bottom. Facebook kn the other hand turned off most functions on mobile, e.g. chat. Good thing though if you don't use the chat long enough, friends start using other means of communication.
whstl 10 hours ago [-]
Haha, yeah. Reddit for the longest time hasn't allowed me to browse certain subreddits without the app. I basically ignore search results from it.
As the sibling poster mentioned, might depend on location, but it DOES happen.
pudgywalsh 15 hours ago [-]
Reddit is NOT FINE. They throw up full page modals now telling you to continue in the app.
embedding-shape 14 hours ago [-]
Soon we'll realize that the experience of using reddit (and other mainstream social media) differs a lot based on what country you're in, and sometimes even the state.
For example, seemingly a bunch of places in Europe/elsewhere has disabled old.reddit.com unless you're logged in, but seemingly a bunch of people in other places can use it just fine. I'm sure what both of you are seeing is both correct, there is just something changing the experience that gets served to each of you.
doubled112 14 hours ago [-]
Log in to use old Reddit
To keep Reddit safe, accounts are required to access old Reddit. Log in, or continue without an account on reddit.com.
First time I've ever seen it. No clear way to bypass it either.
Lio 54 minutes ago [-]
I think it’s a push for either more tracking through login or to push people to more addictive features like endless scrolling and autoplaying videos.
Ntrails 19 hours ago [-]
I just request the desktop site, it's fine
coldtea 17 hours ago [-]
Both are web stores. Both have websites AND apps.
They are compared / contrasted. Nobody is saying one is concretely related to the other.
jusssi 16 hours ago [-]
A lot of people install TikTok. Or Instagram.
crossroadsguy 13 hours ago [-]
Or Claude/etc on their personal computers and then even live dangerously.
croes 15 hours ago [-]
But isn’t the promise of the app store that the apps are checked for malicious code and more control of the permissions compared to a browser website?
lukeify 6 hours ago [-]
That's the promise, yeah.
lovestory 19 hours ago [-]
You probably buy things off amazon that are dropshipped from AliExpress all the time. Stop with the elitism
63stack 19 hours ago [-]
This is not about the products that are shipped, but the app itself. I would caution people to never install it as well.
aureate 19 hours ago [-]
I buy directly from AliExpress all the time. I wouldn't install their app.
mark_something 18 hours ago [-]
On AliExpress I see things like 64 TB (no, not GB!) USB flash drives for less than 10 euro, obviously a scam. I also see less spectacular products but still good looking deals, but without a brand name so you can't search the web for reviews.
On Amazon I never see products like that. That's why I prefer Amazon (and Coolblue and bol.com in Belgium).
subscribed 17 hours ago [-]
I see this kind of fakes on eBay or Amazon all the time. It's even harder to report it than on AliExpress and I never had an obvious report of fakes upheld (AND eBay warns they will forward your identity to the seller. Great thing if the organised crime is involved in this)
Case in point, fake 2TB Sandisk ExtremePro microSD:
Agreed, there's more of that on AliExpress but Amazon is not free from that either.
kees99 18 hours ago [-]
Few years back, Amazon had a rampant "fake USB storage" problem too. Then, one day, all the fakes were gone, just like that.
voakbasda 17 hours ago [-]
If you believe that, I have some USB storage to sell you. Huge capacity, barely used. I keep my inventory in storage under this bridge, which I also happen to have for sale. Interested? ;)
4chandaily 17 hours ago [-]
I can't imagine ever wanting to install an amazon app either. Both of these stores have perfectly functional websites. What would I gain installing their spyware? Also, why so defensive?
Kwpolska 16 hours ago [-]
In first world countries, buying from a local reseller grants you customer rights (like returning or replacing defective items).
lxgr 15 hours ago [-]
Not if the local reseller simply calls itself a marketplace and logistics company and the local regulator lets them get away with it.
Amazon, in my experience, does arbitrate disputes about returns and defects, but the important point is that from a legal perspective, I don't think they have to, so you're at their mercy.
You can't even be sure that VAT is handled correctly, which local retailers can usually not get around.
prartichoke 17 hours ago [-]
I cannot imagine installing amazon as an App as well. It's a website
somehnguy 18 hours ago [-]
Having bought many things off AliExpress over the years I can say with complete confidence that I've never made a purchase on Amazon that was dropshipped from Ali. The shipping times are far different and it would be immediately obvious.
rootusrootus 17 hours ago [-]
Yeah it would be hard to hide. When I order from AliExpress it arrives via Chinese carriers I have never even hard of, and about half the time the final delivery is through a Chinese gig delivery company that must pay practically nothing to the driver because they will usually drive up in front of my house and chuck the package out the window onto my front lawn.
subscribed 17 hours ago [-]
I've ordered things from AliExpress shipped from the local warehouses (2-3 days delivery) ; I've ordered things on Amazon UK that were fulfilled and shipped from Amazon UK that were delivered in 3-5 working days.
Not a £1 tat, and not one off. Not that AliExpress is my choice, no, far from it. Sometimes it's better, closer to the manufacturer, that's all.
ohyoutravel 19 hours ago [-]
Love Temu and AliExpress for specialized components at dirt cheap prices. I would never, ever install their app. Ever, security nightmare.
Similar to how I use Amazon Prime but would never order something I ingest, put on my skin, or (usually) wear from it.
Not elitest.
Lio 39 minutes ago [-]
I would never use Temu for anything.
Elitism has nothing to do with refusing to buy products made with slavery.
A lot of people are critical of historic slavery whilst happily buying from Temu. That’s scummy as hell.
They let all sorts of stuff that they shouldn't in.
For instance, Meta and Google publish 'free' iOS libraries that firehose surveillance data back to them. The libraries are popular, so apps that use them must be allowed into the store despite taking them as dependencies.
If you can get access to .ipa files (I think you'd need to jailbreak -- apparently this stuff is encrypted by Apple) or packet sniffer, then you can get an idea of how bad it is for the apps you use.
This tool claims to do the sort of analysis I'm talking about (among other things), but I've never tried:
I'm wondering if the reviewers neglected to review the app while driving a car and listening to audio.
ngl999 20 hours ago [-]
It's known that some Chinese mobile apps employ this trick to keep the app alive in the background, the rumor is that this way the 'active user' KPI can be better met.
edit: quantity qualifier
echoangle 18 hours ago [-]
Why would they manipulate the numbers that way if it’s self-reported anyways? If you want to fake the numbers, couldn’t you just change the number and be done?
voakbasda 17 hours ago [-]
The people fudging the metric (developers) may not be the same people that are relying on the metrics (managers). Perverse incentives at play could easily motivate this kind of shenanigan.
genidoi 18 hours ago [-]
It's probably quite difficult to manipulate per-user metrics after the data is collected.
SirFatty 19 hours ago [-]
If it's known, are you suggesting that Apple and Google are complacent in allowing these type of apps in their ecosystem?
ngl999 19 hours ago [-]
I wouldn't think of giant organizations like Apple and Google as mere individuals that can exercise human emotions such as complacency.
tomrittervg 11 hours ago [-]
WebAudio fingerprinting is largely mitigated (in Firefox, potentially other browsers) - I wrote a quick overview that talks about the current distribution of values as well as our more recent efforts. https://ritter.vg/blog-webaudio_alibaba.html
emctech 5 hours ago [-]
Thanks for your input and perspective! Do you think it is a bug that the muting of the firefox tab doesn't stop the audio stream?
It is frustrating that companies would use such an annoying tactic to track their users with it also ineffective.
forestry 18 hours ago [-]
So Apple will remove them from the App Store. Thats their whole argument for their closed system - they’ll protect users from malicious apps. Right?
agos 18 hours ago [-]
it's not the app that it's malicious, it's the website
rob-lag 17 hours ago [-]
It's both, according to another comment.
brikym 5 hours ago [-]
And maybe all the big airlines will learn geography 101.
compsciphd 20 hours ago [-]
i'd argue that perhaps the ability to play audio should be permission gated, much like the ability to use webcam/microphone.
However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to.
With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing this, I'll be more willing to be bothered every time I want to play a video with audio to approve it if this bothers me.
rcruzeiro 19 hours ago [-]
I would actually love if I could have iOS prompt me to allow certain apps to use the speakers. I hate using an app and suddenly have a video autoplay loudly.
pavel_lishin 16 hours ago [-]
I wish Android had this as well. There are apps where it's difficult-to-impossible to turn all sound off, and I wish I could just tell my phone that this app is just never allowed to use the speakers.
throw101010 11 hours ago [-]
On Samsung Android phones there is a Samsung app that isn't installed by default that allows to individually manage volume/mute per app called SoundAssistant (and few more neat customizations for audio/audio controls).
You access the features from the OS volume control once installed, there's a "..." button.
Always wondered if that also works on non-Samsung phones, but it's quite useful to forever mute an app.
kccqzy 15 hours ago [-]
Inside iOS accessibility settings you can turn off “auto-play video previews.” This blocks perhaps 20% of video autoplay; it’s still better than nothing.
Philosophically I hate silent video autoplays just as much as I hate autoplays with audio. One distracts your visual attention, the other distracts your aural attention, and I don’t quite understand why society has normalized silent video autoplay.
voakbasda 17 hours ago [-]
This. This needs to be a thing.
GJim 15 hours ago [-]
To be fair, it shouldn't need to be a thing.
(One should really not tolerate such dodgy software).
emctech 20 hours ago [-]
The ability to play audio can usually be permission gated with tab muting, however the methods aliexpress use bypass that mechanism completely.
y-curious 18 hours ago [-]
This is the part you should be highlighting aggressively. That’s very uncomfortable
throw101010 11 hours ago [-]
Firefox allows to Block "Audio and Video" (or "Only Audio") from auto playing per domain, including on Mobile.
miki123211 19 hours ago [-]
Ah, so that's what Wolt (Doordash but in Europe) is doing.
I noticed that Voice Over (iOS screen reader) crackles and randomly changes volume when using the app, but I attributed it to standard iOS weirdness, and possibly misuse of some iOS API. Now I'm thinking that this may very well be fingerprinting.
emctech 21 hours ago [-]
Recently I ran into a problem with my Bluetooth headphones. They support multipoint bluetooth audio, so they can be connected to my PC and phone at the same time.
Opening the Aliexpress webpage causes a silent audio stream keeping the PC>headphone link active blocking my phone audio.
An investigation reveals obfuscated code running device fingerprinting with a side effect being a silent audio stream that firefox, chrome and windows does not recognise but which kept the bluetooth connection active.
maximilianthe1 19 hours ago [-]
Is this an AI summary of the article?
emctech 18 hours ago [-]
No, I took the first sentence of my article and then edited the rest of the intro + conclusion to keep it short for HN.
left-struck 17 hours ago [-]
You should make that obvious in some way like using “TLDR”. I assume many people, like me, would attempt to parse your comment as a comment on the article, after all it’s in the comment section, and read that way it’s very confusing lol.
emctech 17 hours ago [-]
Sorry, this is my first post to HN and in the submission it looked like the description text i added would be part of the post header.
40four 15 hours ago [-]
Don’t apologize. This was a very fascinating read, and a good technical write up, especially for you first even HN post. It’s not your fault others didn’t look at the username :)
emctech 14 hours ago [-]
Thanks for the feedback :D
lxgr 15 hours ago [-]
I was just about to highlight this particular HN quirk. I suppose a lot of people here only ever comment (or submit URLs without any text of their own) and aren't familiar with it.
left-struck 6 hours ago [-]
Sorry, I didn’t realise you were the author
chrisjj 13 hours ago [-]
HN's fault entirely. The post form's actioning "text" as a comment is remiss.
left-struck 6 hours ago [-]
Ah, sorry I wasn’t aware of that either
15 hours ago [-]
40four 15 hours ago [-]
They shouldn’t have to make it “obvious”. They are the actual author of the article. It’s not their fault you didn’t double check the usernames. It’s not uncommon for authors to comment on their own articles.
40four 15 hours ago [-]
No you are talking to the actual author of the article. It’s not weird for the author to comment on their own article
robtherobber 21 hours ago [-]
Concerning situation, I think. And I suspect (perhaps wrongly) that there are even more reasons for concern with technology that can track, capture, leak etc. information that's more sensitive or valuable, depending on how one wishes to look at it. Mobile phones, computers, routers etc. -- all have the potential to siphon out valuable information to a bad actor, especially when it comes to espionage, military, commercial etc. This has already happened at a significant scael, so it's not a remote scenario.
At the very least, governments and institutions should develop a framework to investigate all acquired technology. The community / civil society could also create something similar, a script that would analyse at a deep level everything that can be analysed with a piece of software even by a complete novice.
emctech 21 hours ago [-]
Yes, I find it concerning too. I particularly dislike that windows was not aware, nor could it stop the audio stream from effecting the hardware. What other side channels like that exist? Perhaps I can be blamed for using windows
robtherobber 21 hours ago [-]
> Perhaps I can be blamed for using windows
That would be unreasonable, I argue. No one should have to worry about the security of their devices and data privacy based on which OS they use. Whilst it can be argued that different OSs serve different needs, privacy and security should not be debatable. In fact, most countries have dedicated legislation for this; whether it's just, applied correctly, or serves the public before any other party are indeed discussions to be had.
lnsru 20 hours ago [-]
I am pretty sure my phone is listening. The ads I see this week are about topics I discussed last week. Week for week. Stupid thing is that I need the phone to have near by as self-employed electrician. Clients want to communicate after regular office hours. Since the phone is rigged why computer shouldn’t?
16 hours ago [-]
bobim 20 hours ago [-]
We take everything we have, freedom, privacy, free speech, for granted. The reality seems to be that these concepts are fungible and that we have to be ready to fight for them. Instead we trade these for convenience, and it's very very sad.
19 hours ago [-]
gmueckl 18 hours ago [-]
A part of me is always smiling a little inside when people find creative ways to abuse browsers. It's always one more demonstration that the current web is fundamentally broken by design. The distinction between web browsers and random programs that allow remore arbitrary code execution is becoming more and more academic with every new feature that gets exposed to JavaScript.
Of course, I am also a horrible hypocrite and will actually use websites that use features like WebUSB or WebRTC.
__MatrixMan__ 14 hours ago [-]
It was a mistake to normalize blindly executing whatever code the server sends your browser. One day we'll look back on this era and wish we had pulled the plug sooner.
pyaamb 18 hours ago [-]
Need to rethink the system that allows for (and encourages) this kind of plausible deniability. From "Oh we need this permission for [non essential feature] and you need to accept it if you want the app at all" -> to giving the user ultimate control over what happens on their personal device. Virtualize what the app can see and use fake data/identifiers/devices if necessary to get it to do what its supposed to. If the App isn't going to act in good faith why should the user? Fine grained permissions don't really work in practice because the app can keep annoying the user until they give in and hit Allow.
pyaamb 18 hours ago [-]
Also perhaps AI agents are now capable enough to run these apps the way the user would and recognize these dark patterns. Flag those and feed it back to a warning at the point of sale that users can upvote there to signal their disapproval and a threshold score that risks removal of the app from the store. Because bad behaviour continues to make business sense if the rules allow it. Moreover, it penalizes and puts pressure on the good actors as a "missed business opportunity".
mywittyname 11 hours ago [-]
Maybe just have Claude rebuild the app in a non-scummy way. Analyze the site for the relevant data APIs, while avoiding the tracking stuff. Maybe someone maintains an MCP for these popular websites so people can use agents on them.
ajross 18 hours ago [-]
What you want is basically how it works. On both phone platforms and PWAs, all permissions are visible to the user explicitly. All of them can be revoked at any time. Apps are disallowed from requesting an already-denied permission.
Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party software isn't under any obligation to work without them.
But the platforms have done what the platforms can do, at the architecture side, really. The next stage is human-audited enforcement of malware, which this AliExpress nonsense might hopefully run afoul of.
xnx 18 hours ago [-]
> Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working),
How can they tell? For the permissions I can think of: location, filesystem, etc. it should be easy to lie/spoof.
drdexebtjl 18 hours ago [-]
>Obviously apps can tell if they haven't been granted a permission
By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission.
In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.
victorbjorklund 18 hours ago [-]
Soundd like a nightmare to build legitimate apps if you for example are building an app that uses the camera but you can’t in anyway tell that using the camera fails (because user had denied the permission 6 months ago and has no memory of it) and instead of being able to give a helpful error you are just ending up with I am guessing fake images (maybe just a black screen).
wotb 14 hours ago [-]
Just because it's hard doesn't mean you shouldn't try. What about a popup saying "xyz has tried to access the camera a lot lately, continue blocking?"? Or apps can apply for set of 'core permissions' that can't be denied but are much more tightly controlled? Apple and Google are some of the biggest companies in the world, they don't deserve as much leeway as you're offering.
voakbasda 17 hours ago [-]
The image could contain a message that it is disabled.
victorbjorklund 13 hours ago [-]
So we must also make it impossible for an app to read any images taken inside the app itself? You can’t literally make any apps at all
StingyJelly 16 hours ago [-]
Then it is detectable. Those permissions should have a third option alongside allow and block - spoof.
ajross 18 hours ago [-]
That does nothing but start an arms race. Fine, audio "works" but do you get noise? Can you read back the sounds you play? No, right? It doesn't work, QED. Now the platform needs to fake the noise.
Likewise for any other hardware access you want, and most of them are harder. How do you fake local storage without storing anything? How do you fake Bluetooth access without virtualizing an entire device? Do you fake the screen dimensions to look like something else? Input latency? Where does it stop?
No, "does this work" is among the easiest questions to answer in technology. We aren't going to win this war.
drdexebtjl 13 hours ago [-]
> Can you read back the sounds you play?
No, but you also can’t do that if the user approves your app’s permission to play audio, but has the volume permanently turned down to zero.
> local storage
Give the app a temporary, space-constrained store that isn’t shared with other apps.
> bluetooth
Don’t let apps access raw bluetooth signals, but instead ask the platform to display a pairing interface (possibly with a custom stylesheet), ask the platform to call you back when a specific device is in range, etc.
> screen dimensions
Not personal data.
> input latency
Fudge the numbers even when the user grants permission.
This isn’t a war, it’s just engineering for the benefit and autonomy of the user, and not the platforms’ commercial interests.
ajross 12 hours ago [-]
> This isn’t a war
Fingerprinting and other quasi-malware techniques being used by desirable third party software are absolutely a war, otherwise we wouldn't have this permission structure in place in the first place. And as much as you believe the contrary, Alibaba et. al. are 100% smarter than you about how to exploit these tricks and will win.
> Not personal data.
LOL
drdexebtjl 7 hours ago [-]
I don’t appreciate the personal attack. You don’t know me.
Permissions have nothing to do with preventing fingerprinting, they have to do with user control. Every permission you add that the app can inspect is one extra bit of fingerprint, so it’s actually worse.
In TFA’s case, if the app was simply not hooked up to an actual audio sink, they would still be able to use this mechanism for fingerprinting, since it’s the processing pipeline itself that leaves the fingerprint.
Note that the article isn’t calling out for fingerprinting specifically. I’m sure AliExpress does more fingerprinting than this. The problem is specifically that they’re interfering with multipoint Bluetooth audio.
emctech 17 hours ago [-]
The best you can do on the modern web is reduce your fingerprint footprint, though it comes at a cost of websites breaking from JS disabling, or local time zone anonymisation.
spicyjpeg 20 hours ago [-]
Browser fingerprinting can get creative at times, to say the least. eBay's WebSocket port scanner [1] and Reddit's abuse of DRM and JavaScript JIT exploits [2] from years ago are two examples of the kind of in-depth introspection you can perform completely in the background using nothing more than simple non-permission-gated APIs.
I've seen this on many many other sites as well, most notably Twitter, and lots of common modern captcha pages too. Very annoying!
nkjoep 20 hours ago [-]
JS enabled by default seems every day less secure.
emctech 20 hours ago [-]
So many website break completely with JS disabled and you end up having to enable it half the time anyway.
ruuda 19 hours ago [-]
About half of the time, when a website doesn't work with js disabled, I realize that I didn't want to see the page that badly anyway, and I close the tab.
masfuerte 20 hours ago [-]
It was pretty good until about six months ago. Since then loads of sites have added a js requirement to try to stop the AI bots.
MisterTea 20 hours ago [-]
IMO web browser have been enabling all sorts of obnoxious behavior since before JS. One of my all time favorites were the sites that opened pop-ups in a loop faster than you could close them while an audio clip of a guy yelling "Hey everyone! I'm looking at gay porn!" You had to hit reset. Fuck the Web.
afandian 19 hours ago [-]
The web around the late 90s and early 2000s had some really sketchy stuff. I think the difference is that it used to be the sleazy underbelly. Now it's accepted as mainstream.
My local 'newspaper' website is chock full of scam adverts. The print version is dignified. The website people, somehow, turn a blind eye.
And I got an advert on Youtube this week using sexually explicit language to sell pills.
Feels like standards, and expectations, have really slipped.
grishka 17 hours ago [-]
Opening a popup needs JS though.
nozzlegear 16 hours ago [-]
Not with the new popover API.
grishka 14 hours ago [-]
This doesn't look like it gives websites something they couldn't do before with CSS and JS.
nozzlegear 13 hours ago [-]
I'm pretty sure it does but maybe I'm wrong, I had never tried to create popovers/popups using CSS. What's neat[†] about the popovers API is that it doesn't need any JS, you just write a couple of HTML attributes and voila, a popover/popup. They will run with JS disabled as well.
[†] Neat for me building things like tooltips and dropdowns into my web apps without using JS; not neat for annoying people with popups.
Animats 10 hours ago [-]
You could make a good case for 'exceeds authorized access' under the Computer Fraud and Abuse Act for this. You might even get some action if you filed a complaint, because it's from China.
IX-103 10 hours ago [-]
This is actually a really common form of fingerprinting. At one point in time, it could generally tell the website what operating system and CPU architecture you're running on. I know this type of fingerprinting was fixed in Chrome so it always gives the same answers regardless of platform. I think it was also fixed in Firefox and Safari, but I don't follow their releases as closely.
Of course, even though it's probably useless now, things like that hang around because it costs more for trackers to remove the code than it does to keep it in.
Flow 15 hours ago [-]
I wonder if this is something the iOS Facebook app also does? It constantly pauses my Apple Music playing. Soooo irritating.
admax88qqq 15 hours ago [-]
Somebody (Mozilla?) should make a browser that just proactively blocks shit like this
I’m sure some Adblock addon could do it but at the browser level would be preferred. A browser vendor that just proactively does security and “correctness” tweaks to live sites would actually be in my interests as a user
ibaikov 18 hours ago [-]
I had this (?) happen. I have a soundbar hooked up through spdif in my pc. It automatically switches sources, so I can play music through airplay and then have it play sounds from pc when I open youtube etc. So it switches from airplay music to pc even when nothing is playing on pc. This was happening on some websites and it is extremely annoying.
barrystaes 16 hours ago [-]
Aha this would explain. I have seen similar behaviour with a news website trying DRM requests (has no reason to ask this info) resulting in stopping playback.. did not consider the impact of multipoint here. Interesting, might be worth looking into if i see this "bug" again.
rootsudo 13 hours ago [-]
I’ve noticed this and on other apps too, it breaks AirPods and when background playing Spotify it’s very obvious.
Thanks for investigating! Makes sense it’s also in the taobao app on ios too.
fuzzy2 13 hours ago [-]
When I visit an article on a popular German tech news website, it interrupts music playback on my iPad (the website takes audio focus). I bet they do something similar.
ninalanyon 13 hours ago [-]
Why are web pages allowed by default to do such things? Browsers should give the user the ability to forbid all sorts of thing and have them forbidden by default.
ngl999 20 hours ago [-]
Just curious, why silent sound would allow fingerprinting? What are they sampling if it can't be heard?
emctech 20 hours ago [-]
The script generates a known waveform, it is passed through the browser's audio implementation and then the script analyses the result after. Based on your devices settings and hardware the output will be different, e.g. a PC with analog output might have 44KHz audio output bandwidth, but a bluetooth headset might have a lower, different audio bandwidth. That is a datapoint that can be used in device fingerprinting alongside screen and viewport dimensions,
device pixel ratio, browser plugins, etc.
hunter2_ 16 hours ago [-]
On the one hand, I wouldn't expect too many variations here (the vast majority of devices probably use 48 kHz and 24-bit output, a few use 44.1 kHz and/or 16-bit, etc.) but just like DPR and all the other properties with a very small set of popular values in practice, you only need a bit or two from each measurement to eventually have a high quality fingerprint.
grishka 17 hours ago [-]
Is there any particular reason these kinds of APIs are not behind permission prompts?
julianlam 8 hours ago [-]
I experienced something similar with the AliBaba app. Whenever I had it installed, my Bluetooth devices would only ever send audio in "headset" mode — very poor quality.
Uninstalling the app fixed it up.
sillyboi 18 hours ago [-]
I thought the App Store review guidelines explicitly prohibit hidden features and using public APIs outside their intended purpose. Is audio-based fingerprinting just not something review can realistically catch?
ValdikSS 18 hours ago [-]
They probe all audio devices, including microphones, which probably temporarily switches Bluetooth devices into HPF mode due to how Bluetooth duplex audio works.
I'd argue it's "silent" though: aliexpress wakes up my audio card if nothing plays, which results in a very faint "pop" sound every time I open the tab.
It's been this way for ~3+ years at least.
lapcat 17 hours ago [-]
It's the website.
The title of the article literally mentions "WebAudio", and the first paragraph states that the author is using a PC. The second paragraph mentions Chrome and Firefox.
Apple and the App Store have zero involvement here.
hunter2_ 17 hours ago [-]
This is a huge stretch, but if this problem exists in not only the PC versions of Chrome/Firefox but also the Android/iOS versions, then theoretically the app store reviewers could flag the browsers for facilitating this behavior against app store guidelines. In practice, apps of such caliber as popular browsers might be a bit above such reviewers' pay grade, so to speak.
lapcat 16 hours ago [-]
> This is a huge stretch
This is nonsense. Safari also supports Web Audio. Safari does not, however, support Microsoft Windows, which is why the article author didn't mention it.
Moreover, all web browsers on iOS have to use Apple WebKit, so Web Audio support is not actually the fault of the non-Apple browser vendors.
nazgulsenpai 10 hours ago [-]
> screen and viewport dimensions
I remember trying I think it was the Tor browser, being puzzled at why the viewable area of the window constantly changed when resized but would never occupy the full window.
I feel a little silly now.
jiehong 11 hours ago [-]
This article writing is really clean and enjoyable to read. And I learnt something.
Thank you very much.
hoppp 16 hours ago [-]
Are you not required to grant an explicit permission for it to access audio? If not that is highly disturbing.
fg137 15 hours ago [-]
This at least partially contributed to a sleep related Firefox bug on Windows:
most of the prices change during checkout in the most frustrating ways.
one u ready to check out, and provide ur payment into, and click to pay... they interrupt this fake checkout with a popover, inform u the price is actually much higher, and dangle a button which is one click to accept the new higher price.
this is total scam behaviour and probably illegal in most US states.
sva_ 11 hours ago [-]
I did not have that experience at all, ordered there dozens of times.
mdavidn 14 hours ago [-]
I notice this all of the time on sites with ads. I use AirPods to listen to music on my phone at work. Opening websites on my Mac routinely steals the AirPod connection but plays nothing audible.
tecleandor 15 hours ago [-]
That could explain the multipoint problems I've had in the last weeks, where audio would get "stuck" to one of my devices even when (apparently) nothing is playing.
lxgr 15 hours ago [-]
I've had these issues on and off as early as 10 years ago when I got my first multipoint headphones.
prima-facie 15 hours ago [-]
This is not limited to Bluetooth in any way. In pavucontrol I can see Firefox outputting audio when on AliExpress even though nothing is playing. The uBlock filter fixed it.
ErrorNoBrain 15 hours ago [-]
> The uBlock filter fixed it.
what filter ?
prima-facie 15 hours ago [-]
From the article:
To block the scripts open the uBlock dashboard, select My filters, and add:
No sound playing but the audio would change like the microphone was being activated. I checked permissions to make sure there was no mic access and figured that they were fingerprinting.
emctech 20 hours ago [-]
I had noticed it before but I was browsing AE a lot today and i got fed up with it. What browser and OS are you using?
CTDOCodebases 18 hours ago [-]
It was happening when I was using Chrome on iPhone and Windows 11 with Chrome. I can't remember what was causing it since the headphones (Bose Quietcomfort SE) are synced with both devices. For the last couple of months I've been using Android and I haven't noticed it. The headphones seem to work better with Android. IOS is a bit weird with sharing them with my PC.
big_dave212 15 hours ago [-]
Trying to debug this as a normal user is basically hopeless, you would never think to suspect a shopping tab. Glad someone did the legwork.
emctech 15 hours ago [-]
It just annoyed me so much that it was interrupting my music!
gaudystead 12 hours ago [-]
Hell hath no fury like an inconvenienced power user.
corentin88 10 hours ago [-]
Getting the same issue when opening Stripe Dashboard with AirPod on.
dzonga 12 hours ago [-]
I think x.com does this too - haven't been able to dig deeper.
ankushdograuk 18 hours ago [-]
This is the reason I use adguard everywhere
emctech 18 hours ago [-]
I use ublock origin and by default it wasn't blocking, i had to make a custom filter to block the scripts in order for it to prevent the audio takeover. Maybe adguard does a better job? Someone else suggested just wholesale disabling of JS but it is the nuclear option.
__MatrixMan__ 14 hours ago [-]
Bluetooth is such a mess. You know what didn't have this problem? Cables.
aembleton 10 hours ago [-]
Also, non-multipoint Bluetooth.
nottorp 20 hours ago [-]
Besides the privacy implications, they are also wasting our fucking batteries on this crap...
lapcat 19 hours ago [-]
Cloudflare challenges also use Web Audio, by the way.
emctech 16 hours ago [-]
Does it hold an audio stream open constantly or just briefly during the challenge? On AE it never stops
lapcat 16 hours ago [-]
Just briefly during the challenge.
echelon_musk 20 hours ago [-]
OP please submit the filter to an upstream uBlock filter list.
You can also submit to the EasyPrivacy list or one of the AdGuard lists.
fnwbr 16 hours ago [-]
chimed in... thank you for the great documentation!
emctech 14 hours ago [-]
I am glad people like the write up and it is fostering a conversation! It is such a happenstance that i looked into this.
18 hours ago [-]
like_any_other 5 hours ago [-]
Getting a list of emails from a website by guessing a predictable ID gets your house raided by the FBI and a criminal conviction for accessing a computer without authorization [1]. Why isn't fingerprinting treated the same? And I mean exactly the same - first an FBI raid, arrest, and confiscation of computers, and then they get their day in court.
I doubt the FBI will be flying to china to knock down any doors!
You aren't wrong though, and countries which enforce GDPR I would expect to make noise if this was happening to their constituents.
kinnth 16 hours ago [-]
This sounds like a GDPR issue no? Couldn't they be taken to the EU!
kenniskrag 16 hours ago [-]
Yes. In this case probably not fineeprinting is not allowed because not strictly necessary (cookie law) and therefore needs consent from user.
edelbitter 14 hours ago [-]
Going batshit with browser APIs is also a formidable GDPR defense.
e.g. try browsing the privacy-related forms for Google (https://myaccount.google.com) on Firefox :D
(entire browser freezes up every other second for me, because of some extremely important work Google needs to run on my CPU to let me scroll down on a static site containing roughly 30 words)
theyeenzbeanz 14 hours ago [-]
Can we just limit web APIs to cookies and the likes as before? I don’t like how JavaScript has access to so many devices on the host. It’s a security and privacy nightmare.
docmars 15 hours ago [-]
Sounds like we're gonna need browsers to pop an audio playback permission, as annoying as that seems. Abusive sites just can't help themselves.
downrightmike 15 hours ago [-]
There is no legit reason to be doing this.
shevy-java 16 hours ago [-]
We need to find a solution to browsers sniffing on people. This here refers to AliExpress, but which browsers are typically spying on people like that in the first place? That's the real primary problem.
qurren 15 hours ago [-]
> distinguish normal shoppers from automated
Why? Are you afraid of robots making you rich?
zx8080 7 hours ago [-]
Now, that's why leaving some sites in background empties my phone battery.
amelius 16 hours ago [-]
Are there any EU/GDPR laws against fingerprinting?
kenniskrag 16 hours ago [-]
Yes. In this case probably not allowed because not strictly necessary (cookie law) and therefore needs consent from user.
amelius 15 hours ago [-]
Do we have any jurisprudence on fingerprinting?
kappi 17 hours ago [-]
It's not just BT audio. In windows PC, if aliexpress is opened in one tab in chrome, and switching to a tab with youtube opened, audio don't play in this tab if you start playing youtube.
pama 19 hours ago [-]
Another reason why Lockdown mode on iOS is your friend.
eur0pa 19 hours ago [-]
Lockdown mode is great, but it breaks phone calls on your Apple Watch (found that out the hard way)
realusername 19 hours ago [-]
Somebody else mentioned here that they also do it on the iOS app and I don't see how Lockdown mode would change anything, it doesn't prevent to play audio.
Grombobulous 17 hours ago [-]
If this wasn't such a serious issue I'd be inclined to make a joke about being surprised that AliExpress was capable of such a thing, but I guess the complete shitshow of a website is intentional.
I wouldn't be surprised if what I'm feeling is all a psychological thing where consumers associate jank with low prices so that's why sites like AliExpress and Temu look like a complete technical mess when in reality they're doing pretty advanced stuff like this.
cyteeditor 1 hours ago [-]
[dead]
spawrks 14 hours ago [-]
[dead]
spread2009 18 hours ago [-]
[flagged]
SadErn 14 hours ago [-]
[dead]
handle584 17 hours ago [-]
Meanwhile ppl freak out over Anthropic using timezone and Unicode for the same purpose, without realizing Chinese are simply ruthless in abusing iOS or Android or Web. Pinduoduo, who owns Temu, is infamous for exploiting an Android 0day vulnerability for such purposes.
Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content...
Now I wonder, does this also allow websites to continue running in the background on mobile browsers? Playing media is one of the very few things that can convince iOS Safari to keep a tab running indefinitely, in my experience.
I wonder what kind of person says 'Yes' to this prompt. It gives me the heebie jeebies.
Safari and Firefox allow this by default without a prompt or visible indicator (but maybe that has changed now that Chrome added its dialog).
I can only assume that there are legitimate reasons for this as well, e.g. websites preparing/maintaining audio context for lower latency when they intermittently play audio etc.
Every time an article like this comes out, people wonder about aliexpress instead of why their browser allows this in the first place.
Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.
1. Not make web browser general-purpose runtimes for arbitrary software.
2. OS builds a general-purposes runtime that's completely sandboxed. So users can run more complex software without needing to worry about cruft being installed on their system.
Unfortunately, browser builders have decided that web browsers are #2.
iOS -> Safari
Android -> Chrome
Windows -> Edge (based on Chromium, so fixes in Edge make their way into Chrome too)
You can set per-hostname exceptions if you like! CTRL + I > Permissions
1. Thank you, that's very nice to know about.
2. I really wish this was exposed more directly, probably from the permissions button that is already in the address bar. I can't believe Chrome does this better.
To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my Android phone. It shows a number of sites. Nothing in first party and these that I must fully enable to make the site work (css, image, script, xhr)
* aliexpress.com
* ase.aliexpress.com
* it.aliexpress.com (my country two letters domain)
* umdc-global.aliexpress.com
* aidcgroup.net
* ase.aidcgroup.net
* 67372.ase.aidcgroup.net
* alibaba-inc.com
* epss.alibaba-inc.com
* alicdn.com
* ae01.alicdn.com
* assets.alicdn.com
* aliexpress-media.com
* ae-pic-a1.aliexpress-media.com
* assets.aliexpress-media.com
* aliyun.com
* acjs.aliyun.com
Scary list, right? According to google aidcroup is
> Alibaba International IPP Platform
> https://ipp.aidcgroup.net
> Alibaba International is committed to the protection of intellectual property rights. Right holders and their agents can enforce intellectual property ...
Let me add a /s to the last line
There are two more sites that I can completely block
* googlesyndication.com
* pagead2.googlesyndication.com
so even Alibaba runs ads on Google.
I did not instrument the browser like the author of the post did, so I don't know where the audio comes from. There is nothing listed in the media column of uMatrix. This does not mean that the post is inaccurate. It could be that the browser gets the audio stream from a request in one of the other categories.
uBlockOrigin blocks two of other requests.
1. https://g.alicdn.com/code/npm/@ali/gmod-pop-disclosure-code/...
and this one that I anonymize
2. https://aplus.aliexpress.com/g.gif?logtype=0&title=WebPush Permission&pre=https://it.aliexpress.com/?gatewayAdapt=glo2ita&scr=1920x1080&_p_url=https://it.aliexpress.com/wp.html&cna=<whatever cna is>&category=&aplus=&$${beacon_mini}$$=&yunid=&=&trid=<trid>&asid=<base64 stuff>$${get_sign}$$&p=1&o=linux&b=firefox153&s=1920x1080&w=gecko&ism=other&cache=<7 letters>&lver=8.15.25&jsver=aplus_std&pver=0.7.12&_pw=0&_ph=0&tag=1&stag=-1&lstag=-1&_slog=0
Probably the audio file is coming from one of the unblocked requests but my Debian laptop does not pair with my Bluetooth earpieces so I can't test it.
@FireFoxDudes You need to be addressing fingerprinting
It can be mitigated, a bit, but I don't see how browsers can win that battle.
Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).
There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc.
I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.
The former is traditional analytics and is not enough to uniquely identify an individual.
Not all analytics are as privacy invasive as fingerprinting.
shockingly little information is required to uniquely identify someone.
"traditional analytics" (lets just say os + browser + some hardware info) is likely to be uniquely identifying when combined with just one other sparse dataset.
>Not all analytics are as privacy invasive as fingerprinting.
fingerprinting isn't a separate category of analytics. every data point can be (and often is) used for fingerprinting.
we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored
~every piece of data can be used for fingerprinting. settings and preferences, browser, os, etc. fingerprinting is not its own category of data, it's the correlation of regular data.
the "pressure" ends up being: stop receiving any data at all (which would obviously break ~everything), or put up a warning (leading to fatigue).
consider accessibility settings: absolutely required for some people to browse the internet, but also extremely high-value data for fingerprinting a user.
there is no technical method to know whether a site asking about a visitor's accessibility settings is doing it so that they can properly display content or so that they can fingerprint the visitor. (i.e. there is no "evil bit")
There's always been one, but it's been defaulting to 1 ever since the Web 2.0 upgrade, and the API to set it back to 0 has been deprecated.
I haven’t noticed this recently, but I also now have two newer Phonak hearing aids and a few iOS updates have happened. Maybe the silent Bluetooth shenanigans are less disruptive to my new aids or the programming is different. Surely shenanigans continue.
How much HAs reduce environmental sounds when streaming is configurable by the way, but only by the audiologist if you don't have your own programmer. I don't like the effect and prefer to just turn down the volume manually.
Quite frustrating as I'm often needing to hear the cashier at that point!
At least in the US, I could see that being something that the ADA prohibits.
I tracked it down to American Express's login page (auto loads if you leave the site idle) relying on Akamai's anti bot measures polling some web Bluetooth feature, causing Chrome to trigger a BT scan: https://castle.io/research/fingerprint-harvesting-in-the-bot...
Turning off Bluetooth solves it, but that's not a great solution when using a Bluetooth mouse... and it sounds like it might be causing your issue too.
I would suspect that this only happens when you're charging and it is likely the charger or cable not being properly shielded.
Charging only happens while in the cradle, not while worn.
I don't think you know what you are talking about
At least Aliexpress doesn't have all the fake slot machine type games that temu has that always end in variations of "get $200 of discounts for your next order if you order x items from this list"
So I would register a new account for each order -- 10 USD is quite a lot of money in my country -- and saved at least a hundred on buying dev boards and other components.
Like a white van with FREE CANDY written on it...
What, I suddenly need to buy Alibaba crap and I can't wait to get to a laptop browser?
"Why would anyone install a random app"
"Why would anyone use a phone to make a purchase"
--
Globally, more than half of all eCommerce purchases are made on a phone or tablet.
Using my computer just now, I looked at one of the emails that AliExpress sent about this order. It had a clickable tracking number displayed; I clicked it.
That brought me to their website, where I landed on a page that included the last update for my order and also a link to "View Details".
That works for me. It was very easy to where along the line my stuff is (and that it is not in the US yet).
---
Meanwhile: I also copied the tracking number from the email. I pasted that tracking number into the box at usps.com.
The USPS knows of my tracking number and they do not have my item yet. Fair enough.
I ticked some boxes and told them to send me updates, which I'm sure they'll do once they have updates to send -- just as they have done for ~decades now.
This also works for me.
Companies are not going to hire a mobile dev team to create an app to give you a way to pay them less for a good.
They hire a mobile dev team to create an app to give you a way to hand over data that you otherwise wouldn't, is technically impossible to do through a web browser, and is worth more than the discount that they give you for using the app.
This should be illegal
Translation: They are able to mine your personal data more completely with an app installed vs the website which they can sell for pure profit. They promoted installing it to extract more value from you.
But there is another, slightly less evil, explanation that I know at least some companies have pushed their apps because of: the thinking is that if you're on their website, there is less friction to open a new tab and search for a lower price from their competitors, than if you're in their app. Obviously it's hardly any different - opening a new app (the web browser) vs. opening a new tab in the app you're already in - but the theory is that there's a slight psychological difference.
Of course I'm not saying that trying to prevent your customers from searching for better deals is a nice thing to do. Just adding that data mining isn't the only reason for some companies to want people to use their apps.
Should you ever need someone in a foreign country to do something for you, it's good to have as much information as possible at your disposal about them.
....and yes, many HN'ers were clearly happy to give there precise GNSS coordinates to some random scrote who askes for them.
I study Apple's Privacy Nutrition Labels religiously every time I consider installing an app.
I like the ones with "Data Not Collected".
Here's a good overview of the problem: https://arxiv.org/abs/2206.02658v3
I can't help but feel the whole Apple privacy PR will be blown in the future where some report will come out that Apple has been logging and sharing user data with NSA since 2001.
Reminds me of meat processing regulations. I can sell my animals whole to buyers through a custom processing exemption, but they must go pick up their meat from the butcher. The law says I cannot pick up and deliver it, but it is trivial to find people advertising that extra service. Reporting them does not result in any obvious action.
In both of our cases, our honesty is a liability in the marketplace, because people are ignorant of such laws (or simply don’t care). Really, they simply want the product that they want, as conveniently as possible. We are then forced to compete in the marketplace with liars and cheats.
I am sure our peers here can find countless examples in other areas where this flavor of dishonesty prevails. Hell, I would love to hear some counter examples, because I cannot help but view this state of affairs as intentional at this point.
The purpose of system is what it does (or, in this case, does not do).
Screen real estate is precious on phones, so being able to permanently block "Install our app!" and even entire navigation categories (shorts on LinkedIn) is quite valuable.
Then you can "install" the site on your home screen or simply place it in collection folders so it's sitting ready on your "New Tab" page.
I dropped their .com into a Home Screen icon, and this completely stopped (at least as far as I’ve observed). It’s definitely more janky from an experience perspective, but still easier than driving to the store.
While browsing, there are also popups offering the app approximately every third link I click. Some of them are telling me to install the app.
Unless the situation has changed recently, it's not perfectly fine, it is unusable on purpose.
"The app is great because the website is heavily degraded".
As the sibling poster mentioned, might depend on location, but it DOES happen.
For example, seemingly a bunch of places in Europe/elsewhere has disabled old.reddit.com unless you're logged in, but seemingly a bunch of people in other places can use it just fine. I'm sure what both of you are seeing is both correct, there is just something changing the experience that gets served to each of you.
They are compared / contrasted. Nobody is saying one is concretely related to the other.
On Amazon I never see products like that. That's why I prefer Amazon (and Coolblue and bol.com in Belgium).
Case in point, fake 2TB Sandisk ExtremePro microSD:
- £17 on eBay: https://www.ebay.co.uk/itm/336728033240 - even the images prove it's a fake (also $570 on sandisk.com)
Agreed, there's more of that on AliExpress but Amazon is not free from that either.
Amazon, in my experience, does arbitrate disputes about returns and defects, but the important point is that from a legal perspective, I don't think they have to, so you're at their mercy.
You can't even be sure that VAT is handled correctly, which local retailers can usually not get around.
Not a £1 tat, and not one off. Not that AliExpress is my choice, no, far from it. Sometimes it's better, closer to the manufacturer, that's all.
Similar to how I use Amazon Prime but would never order something I ingest, put on my skin, or (usually) wear from it.
Not elitest.
Elitism has nothing to do with refusing to buy products made with slavery.
A lot of people are critical of historic slavery whilst happily buying from Temu. That’s scummy as hell.
https://www.bbc.co.uk/news/business-67752413
For instance, Meta and Google publish 'free' iOS libraries that firehose surveillance data back to them. The libraries are popular, so apps that use them must be allowed into the store despite taking them as dependencies.
If you can get access to .ipa files (I think you'd need to jailbreak -- apparently this stuff is encrypted by Apple) or packet sniffer, then you can get an idea of how bad it is for the apps you use.
This tool claims to do the sort of analysis I'm talking about (among other things), but I've never tried:
https://securitywall.co/tools/ipa-analyzer
edit: quantity qualifier
However, I'd bet that many people will gladly allow aliexpress to play audio as there are probably videos on the site that people want to play and listen to.
With that said, its possible that this can be only a use once permission. Even if I want to shop at aliexpress if I know they are doing this, I'll be more willing to be bothered every time I want to play a video with audio to approve it if this bothers me.
I don't think many people know about it, it's made by Good Lock Labs which is basically a group of Samsung devs making advanced customization apps: https://galaxystore.samsung.com/detail/com.samsung.android.s...
You access the features from the OS volume control once installed, there's a "..." button.
Always wondered if that also works on non-Samsung phones, but it's quite useful to forever mute an app.
Philosophically I hate silent video autoplays just as much as I hate autoplays with audio. One distracts your visual attention, the other distracts your aural attention, and I don’t quite understand why society has normalized silent video autoplay.
(One should really not tolerate such dodgy software).
I noticed that Voice Over (iOS screen reader) crackles and randomly changes volume when using the app, but I attributed it to standard iOS weirdness, and possibly misuse of some iOS API. Now I'm thinking that this may very well be fingerprinting.
At the very least, governments and institutions should develop a framework to investigate all acquired technology. The community / civil society could also create something similar, a script that would analyse at a deep level everything that can be analysed with a piece of software even by a complete novice.
That would be unreasonable, I argue. No one should have to worry about the security of their devices and data privacy based on which OS they use. Whilst it can be argued that different OSs serve different needs, privacy and security should not be debatable. In fact, most countries have dedicated legislation for this; whether it's just, applied correctly, or serves the public before any other party are indeed discussions to be had.
Of course, I am also a horrible hypocrite and will actually use websites that use features like WebUSB or WebRTC.
Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party software isn't under any obligation to work without them.
But the platforms have done what the platforms can do, at the architecture side, really. The next stage is human-audited enforcement of malware, which this AliExpress nonsense might hopefully run afoul of.
How can they tell? For the permissions I can think of: location, filesystem, etc. it should be easy to lie/spoof.
By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission.
In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.
Likewise for any other hardware access you want, and most of them are harder. How do you fake local storage without storing anything? How do you fake Bluetooth access without virtualizing an entire device? Do you fake the screen dimensions to look like something else? Input latency? Where does it stop?
No, "does this work" is among the easiest questions to answer in technology. We aren't going to win this war.
No, but you also can’t do that if the user approves your app’s permission to play audio, but has the volume permanently turned down to zero.
> local storage
Give the app a temporary, space-constrained store that isn’t shared with other apps.
> bluetooth
Don’t let apps access raw bluetooth signals, but instead ask the platform to display a pairing interface (possibly with a custom stylesheet), ask the platform to call you back when a specific device is in range, etc.
> screen dimensions
Not personal data.
> input latency
Fudge the numbers even when the user grants permission.
This isn’t a war, it’s just engineering for the benefit and autonomy of the user, and not the platforms’ commercial interests.
Fingerprinting and other quasi-malware techniques being used by desirable third party software are absolutely a war, otherwise we wouldn't have this permission structure in place in the first place. And as much as you believe the contrary, Alibaba et. al. are 100% smarter than you about how to exploit these tricks and will win.
> Not personal data.
LOL
Permissions have nothing to do with preventing fingerprinting, they have to do with user control. Every permission you add that the app can inspect is one extra bit of fingerprint, so it’s actually worse.
In TFA’s case, if the app was simply not hooked up to an actual audio sink, they would still be able to use this mechanism for fingerprinting, since it’s the processing pipeline itself that leaves the fingerprint.
Note that the article isn’t calling out for fingerprinting specifically. I’m sure AliExpress does more fingerprinting than this. The problem is specifically that they’re interfering with multipoint Bluetooth audio.
[1] https://blog.nem.ec/2020/05/24/ebay-port-scanning/
[2] https://iter.ca/post/reddit-whiteops/
My local 'newspaper' website is chock full of scam adverts. The print version is dignified. The website people, somehow, turn a blind eye.
And I got an advert on Youtube this week using sexually explicit language to sell pills.
Feels like standards, and expectations, have really slipped.
https://chrisburnell.com/html-can-do-that/
[†] Neat for me building things like tooltips and dropdowns into my web apps without using JS; not neat for annoying people with popups.
Of course, even though it's probably useless now, things like that hang around because it costs more for trackers to remove the code than it does to keep it in.
I’m sure some Adblock addon could do it but at the browser level would be preferred. A browser vendor that just proactively does security and “correctness” tweaks to live sites would actually be in my interests as a user
Thanks for investigating! Makes sense it’s also in the taobao app on ios too.
Uninstalling the app fixed it up.
I'd argue it's "silent" though: aliexpress wakes up my audio card if nothing plays, which results in a very faint "pop" sound every time I open the tab.
It's been this way for ~3+ years at least.
The title of the article literally mentions "WebAudio", and the first paragraph states that the author is using a PC. The second paragraph mentions Chrome and Firefox.
Apple and the App Store have zero involvement here.
This is nonsense. Safari also supports Web Audio. Safari does not, however, support Microsoft Windows, which is why the article author didn't mention it.
Moreover, all web browsers on iOS have to use Apple WebKit, so Web Audio support is not actually the fault of the non-Apple browser vendors.
I remember trying I think it was the Tor browser, being puzzled at why the viewable area of the window constantly changed when resized but would never occupy the full window.
I feel a little silly now.
Thank you very much.
https://bugzilla.mozilla.org/show_bug.cgi?id=1863193
most of the prices change during checkout in the most frustrating ways. one u ready to check out, and provide ur payment into, and click to pay... they interrupt this fake checkout with a popover, inform u the price is actually much higher, and dangle a button which is one click to accept the new higher price.
this is total scam behaviour and probably illegal in most US states.
what filter ?
To block the scripts open the uBlock dashboard, select My filters, and add:
No sound playing but the audio would change like the microphone was being activated. I checked permissions to make sure there was no mic access and figured that they were fingerprinting.
[1] https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_emai...
Why? Are you afraid of robots making you rich?
I wouldn't be surprised if what I'm feeling is all a psychological thing where consumers associate jank with low prices so that's why sites like AliExpress and Temu look like a complete technical mess when in reality they're doing pretty advanced stuff like this.