HN Debrief

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

  • Privacy
  • Security
  • Browsers
  • Mobile
  • Developer Tools

The post documents an ugly side effect of WebAudio fingerprinting on AliExpress. Its scripts generate audio locally with an oscillator, inspect the processed result for device-specific signals, and in the process keep an audio stream open even though nothing audible plays. On systems using Bluetooth multipoint, that is enough to hold the headset on the PC and block phone audio. People also reported faint pops, audio focus theft, broken car and hearing-aid behavior, and music playback being interrupted on other devices. Several commenters pointed out that this is not some exotic AliExpress-only trick. WebAudio fingerprinting has been common for years, Cloudflare challenges use it briefly, and other anti-bot and tracking systems lean on similarly permissive browser APIs like WebBluetooth and WebSockets.

Treat silent media activity as a real privacy and UX risk, not a weird Bluetooth bug. If your product depends on browser audio APIs or anti-bot scripts, audit for side effects now and expect users and browser vendors to push for stricter autoplay and audio permissions.

Discussion mood

Strongly negative. People saw the behavior as invasive, battery-wasting, and absurdly hard to debug, with extra anger that browsers and mobile platforms allow silent audio and related APIs to affect hardware without obvious indicators or user control.

Key insights

  1. 01

    Hearing aids get hit harder

    The impact is worse than a stolen music stream if you use hearing aids or cochlear implant processors. Multiple people said silent audio causes their devices to reduce ambient amplification, because Bluetooth streaming changes the aid’s internal mix to favor streamed content. That turns a tracking side effect into an accessibility problem, not just an annoyance.

    If your users depend on assistive audio devices, test for any background audio session or focus change even when playback is inaudible. Silent streams can degrade accessibility features long before anyone notices a privacy issue.

      Attribution:
    • retrac #1
    • jonathanlb #1
    • kevin_thibedeau #1
  2. 02

    Anti-bot stacks trigger similar hardware side effects

    AliExpress is not alone and fingerprinting is not limited to WebAudio. One report traced periodic system stutter on the American Express login page to Akamai anti-bot code polling WebBluetooth, while another pointed to earlier cases like eBay’s WebSocket port scanning and Reddit’s DRM and JavaScript JIT probing. The useful framing is that anti-abuse vendors already treat the browser as a sensor suite, so weird device behavior can come from fraud tooling, not just ads or media code.

    When users report unexplained Bluetooth scans, stutter, or device state changes, inspect third-party fraud and bot-mitigation scripts first. They can have system-level side effects that look nothing like ordinary web bugs.

      Attribution:
    • BoorishBears #1
    • spicyjpeg #1
  3. 03

    WebAudio fingerprinting is weaker than it used to be

    A Mozilla engineer said Firefox has already added mitigations and linked an overview of current WebAudio fingerprint distributions. Another commenter noted Chrome moved toward returning normalized values too. That changes the story from "new exploit" to "old technique still shipped everywhere," with the bigger failure being that dead or degraded fingerprinting code still causes live hardware disruption.

    Do not assume old fingerprinting snippets are harmless because vendors reduced their entropy. Even weakened signals can still waste battery, steal focus, and break peripherals, so remove stale detection code instead of leaving it in place.

      Attribution:
    • tomrittervg #1
    • IX-103 #1
  4. 04

    Filter-list maintainers may not save you

    The article’s custom uBlock Origin rules work, but the first attempt to upstream them was reportedly rejected. Others suggested EasyPrivacy or AdGuard instead. The larger lesson is that privacy tooling does not always classify this kind of script as blockworthy fast enough, especially when it lives inside first-party commerce domains instead of obvious third-party trackers.

    If a bug depends on first-party tracking code, be ready to ship your own block rules or domain-specific mitigations. Waiting for general-purpose filter lists can leave users exposed for a long time.

      Attribution:
    • prima-facie #1
    • emctech #1
    • quinncom #1
  5. 05

    Users cannot see live audio contexts clearly enough

    Several people expected a speaker icon or similar tab indicator to light up the moment a site created audio activity that touches hardware. The fact that silent playback often avoids obvious browser UI is the reason this went unnoticed. Commenters pushed beyond notification and argued for blocking by default, similar to autoplay restrictions, because invisibility is what turns a niche API into a practical abuse channel.

    Browser and app teams should treat observability as a security control. If audio state is not obvious in the UI, abuse will survive far longer than any policy or review rule.

      Attribution:
    • lxgr #1
    • emctech #1
    • ajsnigrutin #1

Against the grain

  1. 01

    Bluetooth multipoint is part of the fragility

    Some people blamed the browser stack, but others noted they have seen multipoint weirdness for years across devices and platforms. One user stopped noticing the problem after switching from iPhone to Android with the same headphones. That does not excuse AliExpress, but it does mean the symptom depends on a brittle Bluetooth stack as much as on the tracking script itself.

    If you are reproducing or fixing this class of bug, test across headset models and host platforms before assuming one root cause. The same script can look catastrophic on one Bluetooth stack and barely visible on another.

      Attribution:
    • bigbuppo #1
    • CTDOCodebases #1
  2. 02

    Browsers cannot reliably label fingerprinting intent

    Calls for browsers to throw a big warning on fingerprinting ran into a blunt technical objection. Almost any browser property or API can be used either for legitimate functionality or for correlation across visits, so intent is not machine-detectable in a useful way. A generic warning would fire on an enormous share of modern sites and quickly train users to ignore it.

    Expect effective defenses to come from reducing entropy, sandboxing APIs, and tightening defaults, not from a single "this site is fingerprinting you" banner. Product teams should avoid compliance theater that users will click through instantly.

      Attribution:
    • miki_oomiri #1
    • john_strinlai #1 #2

In plain english

Akamai
A large infrastructure and security vendor whose services include bot detection and anti-abuse tooling for websites.
audio focus
An operating system mechanism that decides which app or tab currently controls audio playback or gets priority on an audio device.
Autoplay
A feature that starts the next video or piece of content automatically without the user choosing it.
Bluetooth multipoint
A Bluetooth feature that lets headphones or speakers stay connected to more than one device at the same time and switch between them.
Cloudflare
A company that provides CDN, caching, and network services to speed up and protect websites.
DRM
Digital Rights Management, technical controls used by media companies to restrict copying and playback of digital content.
EasyPrivacy
A widely used filter list focused on blocking web tracking and privacy-invasive requests.
fingerprinting
A tracking technique that combines many small details about a device or browser to recognize a user without relying on cookies.
JIT
Just-In-Time compilation, a technique that converts code to machine instructions while a program is running to improve performance.
uBlock Origin
A browser extension that blocks ads, trackers, and unwanted page elements.
WebAudio
A browser programming interface for generating and processing sound inside a web page.
WebBluetooth
A browser programming interface that lets websites interact with nearby Bluetooth devices, usually after some user action or permission flow.
WebSocket
A web technology for keeping a persistent two-way network connection open between a browser and a server.

Reference links

Background on browser fingerprinting abuse

Browser mitigations and debugging

Blocking and analysis tools

Related privacy references