AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
- Privacy
- Security
- Browsers
- Mobile
- Developer Tools
The post documents an ugly side effect of WebAudio fingerprinting on AliExpress. Its scripts generate audio locally with an oscillator, inspect the processed result for device-specific signals, and in the process keep an audio stream open even though nothing audible plays. On systems using Bluetooth multipoint, that is enough to hold the headset on the PC and block phone audio. People also reported faint pops, audio focus theft, broken car and hearing-aid behavior, and music playback being interrupted on other devices. Several commenters pointed out that this is not some exotic AliExpress-only trick. WebAudio fingerprinting has been common for years, Cloudflare challenges use it briefly, and other anti-bot and tracking systems lean on similarly permissive browser APIs like WebBluetooth and WebSockets.
Treat silent media activity as a real privacy and UX risk, not a weird Bluetooth bug. If your product depends on browser audio APIs or anti-bot scripts, audit for side effects now and expect users and browser vendors to push for stricter autoplay and audio permissions.
-
blog.laserphile.com
- Discuss on HN