AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint(blog.laserphile.com)
1011 points by emctech 1 day ago | 327 comments
tl;dr: AliExpress silently loads two obfuscated Alibaba anti-fraud scripts (collina.js and fireyejs.js) that create hidden WebAudio graphs — a sawtooth oscillator routed through an analyser and zero-gain node to the audio destination — as part of a broader browser fingerprint covering canvas, WebGL, hardware, and interaction data. Because the graph is connected to the system audio output (despite being silent), it keeps the PC's Bluetooth audio path active, breaking multipoint headphone switching to other devices. Blocking the two scripts via uBlock Origin filters stops the behavior, though it may trigger additional CAPTCHAs.
HN Discussion:
  • Browsers should flag or gate silent audio playback like other permissions
  • Personal corroboration of Bluetooth/audio disruption from AliExpress or similar apps
  • WebAudio fingerprinting is already being mitigated by browsers like Firefox
  • Broader concern about pervasive fingerprinting and data exfiltration across devices
  • Recommends defensive tools like NoScript to control script execution