Inaudible sounds used to fingerprint browsers catch AliExpress red-handed

利用不可听声音进行浏览器指纹追踪，速卖通（AliExpress）被当场抓获

Chinese retailer AliExpress has been caught fingerprinting visitors after one of the metrics—an outdated technique that measures inaudible sounds it sends to browsers—impeded a researcher’s ability to use his bluetooth headphones. 中国零售商速卖通（AliExpress）近日被发现正在对访问者进行“指纹追踪”。起因是该网站使用了一种过时的技术，通过向浏览器发送不可听的声音来获取设备特征，而这一过程干扰了一名研究人员使用其蓝牙耳机的正常功能。

Researcher Matthew Callaghan said he stumbled on the stealthy tracking by mistake. After loading the AliExpress homepage, audio from his phone stopped playing over his multipoint headphones, which accept connections from more than one device at a time. He set the headphones to play sounds from his phone except when his PC was producing audio. Each time he loaded AliExpress, the phone audio stopped. Each time he closed the tab the site was loaded into, the phone was once again audible. 研究人员马修·卡拉汉（Matthew Callaghan）表示，他是偶然发现了这种隐蔽的追踪行为。在加载速卖通主页后，他发现手机音频停止在多点连接蓝牙耳机（支持同时连接多个设备）上播放。他原本设置耳机在电脑不发声时播放手机音频，但每当他加载速卖通页面时，手机音频就会中断；而每当他关闭该网站标签页，手机音频便恢复正常。

Users can’t hear it, but browsers can

用户听不见，但浏览器可以

While investigating the odd behavior, Callaghan said he found two highly obfuscated scripts. Together, they rendered a graph that analyzed the WebAudio readings of each visiting browser. This graph acted as an oscillator that measured Sawtooth waves, which are common in output from digital audio. 在调查这一异常行为时，卡拉汉发现两个高度混淆的脚本。它们共同渲染出一个图表，用于分析每个访问者浏览器的 WebAudio 读数。该图表充当了一个振荡器，用于测量数字音频输出中常见的锯齿波。

“The oscillator generates a known waveform,” Callaghan wrote. “The analyser measures the result after it has passed through the browser’s audio implementation, and the script reads frequency data from it.” The scripts set the gain to zero to prevent users from hearing anything. But because the graph is still connected to the selected system audio, the browser continues to process it and, eventually, sends it to AliExpress. “振荡器生成一个已知的波形，”卡拉汉写道，“分析器在波形通过浏览器的音频实现后测量结果，脚本则从中读取频率数据。”这些脚本将增益设置为零，以防止用户听到任何声音。但由于该图表仍连接到选定的系统音频，浏览器会持续处理它，并最终将其发送给速卖通。

Variability in different math libraries, which are used when audio is produced through browsers, were once high enough to provide a massively large number of uniquely different signatures when combined with different CPUs and other system differences. 当通过浏览器产生音频时，不同数学库之间的差异性曾经非常大，结合不同的 CPU 和其他系统差异，足以提供海量且独特的设备签名。

After the audio soundprinting technique became well known, Firefox implemented a fix, starting in version 118 released in 2023. Beginning then, the browser used its own unique math libraries, rather than relying on ones that shipped with the OS it ran on. Tom Ritter, a Firefox developer who has also volunteered for the Tor Project, said the move to constant libraries reduced the entropy enough to stop the technique from working. The technique is ineffective in Chrome because it, too, ships with its own libraries, a Google spokesperson said. Safari users are likely safe for the same reason, although Apple didn’t immediately confirm that. 在音频指纹技术广为人知后，Firefox 从 2023 年发布的 118 版本开始实施了修复。从那时起，该浏览器开始使用其自带的数学库，而不是依赖操作系统自带的库。Firefox 开发人员、Tor 项目志愿者汤姆·里特（Tom Ritter）表示，转向使用固定库有效地降低了熵值，从而使该技术失效。谷歌发言人表示，该技术在 Chrome 中也无效，因为它同样内置了自己的库。Safari 用户可能也处于安全状态，尽管苹果公司并未立即对此予以确认。

An artifact from years past

来自往日的“遗迹”

AliExpress’ use of an obsolete fingerprinting method raises the question: Why is it bothering to use it? The likely answer has to do with the more than a dozen other fingerprinting methods the online retailer is using. Callaghan said the other techniques included: canvas rendering and toDataURL() WebGL renderer information, extensions, and shader precision audio oscillator and analyzer output screen and viewport dimensions device pixel ratio hardware concurrency and device memory installed browser plugins supported audio and video formats WebRTC behavior browser performance timing mouse, touch, focus, and scroll events device motion and orientation properties commonly associated with browser automation. 速卖通使用这种过时的指纹追踪方法引发了一个问题：为什么要费心使用它？可能的答案与该在线零售商正在使用的其他十几种指纹追踪方法有关。卡拉汉表示，其他技术包括：Canvas 渲染和 toDataURL()、WebGL 渲染器信息、扩展程序和着色器精度、音频振荡器和分析器输出、屏幕和视口尺寸、设备像素比、硬件并发和设备内存、已安装的浏览器插件、支持的音视频格式、WebRTC 行为、浏览器性能计时、鼠标、触摸、焦点和滚动事件、设备运动和方向属性，以及通常与浏览器自动化相关的属性。

It’s likely the web audio trick is left over from years earlier and no one noticed it until now. It’s comforting to know that browser makers have taken precautions. At the same time, it’s not yet clear how effective the rest of the metrics AliExpress is using are. Less reassuring still: it’s almost a certainty that thousands of sites are employing similar tracking. Browser developers are in a dynamic race with site publishers, who are constantly looking for new ways to break the latest protections. 这种 Web 音频技巧很可能是多年前遗留下来的，直到现在才被人发现。令人欣慰的是，浏览器厂商已经采取了预防措施。与此同时，速卖通使用的其他指标到底有多有效尚不清楚。更令人不安的是：几乎可以肯定，成千上万的网站都在使用类似的追踪手段。浏览器开发者正与网站发布者进行一场动态竞赛，后者不断寻找新的方法来突破最新的保护措施。