Brave Browser Reports Alibaba's AliExpress Found Using User Audio Systems for Tracking
AliExpress Uses Silent Audio for Fingerprinting
Brave Browser reported that Alibaba's AliExpress was found using user audio systems for tracking.
AliExpress does not record user voices but plays silent audio and measures subtle differences in how devices process that audio to build browser fingerprints. This method is implemented via the WebAudio API, is imperceptible to users, and the tab speaker icon does not light up, but headphones interrupt multi-point connections due to detecting the audio stream.
The discovery stemmed from users' Bluetooth headphones being unable to switch devices, and upon investigation, it was confirmed that AliExpress's backend continuously played silent audio. The post received 723 points and 240 discussions on Hacker News, focusing on why browsers do not alert users to such background activities.
Brave injects random data by default to interfere with fingerprinting and blocks related scripts to protect users from audio fingerprint tracking.
In terms of market mechanisms, e-commerce platforms collect device characteristics through silent audio for anti-fraud and tracking, with funds and data flowing to fingerprint recognition systems. The beneficiaries are platform risk control, while users' privacy and multi-device audio experience are under pressure.
Supplementary data shows that similar fingerprint technologies combined with canvas, WebGL, etc., form comprehensive device identifiers, and Brave has been protecting against this for over six years.
Source: Public Information
ABAB AI Insight
The WebAudio fingerprinting used by AliExpress is an evolution of browser fingerprinting technology, identifying devices through hardware audio processing differences, bypassing traditional cookie restrictions. Similar methods have been widely used in anti-fraud scenarios, but the side effects were exposed for the first time due to Bluetooth multi-point connections.
In terms of capital pathways, Alibaba's security scripts continuously run silent audio streams, sending device characteristic data back to servers. The motivation is to enhance risk control accuracy and cross-session tracking capabilities while minimizing user awareness to reduce complaint risks.
Similar cases can be seen with other large platforms using canvas or font fingerprinting, with Brave and Firefox countering through output randomization. We are currently in a phase where fingerprinting technology is shifting from visible tracking to completely silent methods.
The structural judgment indicates a technological replacement: traditional cookies are replaced by hardware-level fingerprints, with the mechanism being that audio processing differences provide persistent identifiers, allowing platforms to maintain user profiles without consent, while exposing the browser's lack of alerts for background audio activities.
ABAB News · Cognitive Laws
Silence can also become a tracking entry point
Side effects are often discovered before privacy issues
Default protection is more effective than post-facto switches