AliExpress Silently Tracks Users with Audio Fingerprinting, Collects Device Fingerprints, Sparking Heated Discussions on Social Media
AliExpress silently creates two WebAudio audio contexts on its homepage, generating and analyzing waveforms through a zero-volume sawtooth oscillator to collect device fingerprints.
The scripts collina.js and fireyejs.js are loaded by Alibaba's anti-abuse toolchain, starting the AudioContext and connecting to the system audio output after the page is idle for a few seconds. A zero-gain node ensures no audible sound, while the browser and operating system still recognize it as real-time audio processing.
When different operating systems, browser versions, sound card hardware, and audio drivers process the same mathematical waveform, tiny mathematical differences arise, forming unique device characteristics. These are encrypted and sent back to Alibaba's telemetry server, combined with canvas rendering, WebGL information, hardware specifications, WebRTC behavior, and interaction data.
This process has no visible media elements, no play calls, and no MediaSession; muting the tab or the system has no effect, causing Bluetooth headphones that support multi-point connections to lock onto the computer's audio channel, immediately interrupting phone music or calls, which resume after closing the tab.
Privacy browsers like Firefox and Brave have weakened the effectiveness of audio fingerprinting through anti-fingerprinting technologies. Some users reported that the issue disappeared after blocking the aforementioned scripts with uBlock Origin. Discussions on Hacker News have exceeded a thousand points and sparked widespread technical replication.
E-commerce platforms are continuously upgrading their device fingerprinting systems to combat account hijacking, fake accounts, web scraping, payment fraud, and coupon abuse, replacing easily cleared cookies. Resources are being directed towards anti-fraud and security infrastructure, benefiting platform risk control capabilities while putting pressure on user privacy and device audio control. This incident has driven users and browser vendors to strengthen interception.
Source: Public Information
ABAB AI Insight
Alibaba has previously deployed multiple layers of browser fingerprinting in its anti-fraud system, including canvas, WebGL, and hardware concurrent collection. This WebAudio extension continues its AWSC security script path, similar to past enhancements against automated tools and abnormal logins.
Capital and technical resources are concentrated on persistent device-level identifiers, motivated by reducing fraud losses and improving risk control accuracy. By obfuscating scripts and telemetry feedback, a closed loop is formed, shifting resources from basic e-commerce operations to underlying browser behavior monitoring.
Similar to early advertising networks using canvas fingerprints or hardware signal schemes from fingerprint companies like FingerprintJS, AliExpress is in an expansion phase transitioning from cookie dependency to hardware-level control. The industry as a whole is moving from session tracking to cross-session device binding.
This essentially represents a technological substitution in the restructuring of the industry chain. After the failure of cookies, platforms are using audio processing differences to replace traditional identifiers. The mechanism relies on the operating system and browser's hard resource occupation of real-time audio graphs, which cannot be blocked by ordinary users or standard muting, thereby forcibly retaining device uniqueness.
ABAB News · Cognitive Laws
A silent channel is a permanent label.
The stronger the anti-fraud measures, the weaker the user control.
Hardware differences are the new identity currency.