Top
Best
New

Posted by emctech 11 hours ago

AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint(blog.laserphile.com)
765 points | 260 commentspage 2
br0ceph 1 hour ago|
aliexpress is largely a bait and switch site.

most of the prices change during checkout in the most frustrating ways. one u ready to check out, and provide ur payment into, and click to pay... they interrupt this fake checkout with a popover, inform u the price is actually much higher, and dangle a button which is one click to accept the new higher price.

this is total scam behaviour and probably illegal in most US states.

sva_ 1 hour ago|
I did not have that experience at all, ordered there dozens of times.
pyaamb 8 hours ago||
Need to rethink the system that allows for (and encourages) this kind of plausible deniability. From "Oh we need this permission for [non essential feature] and you need to accept it if you want the app at all" -> to giving the user ultimate control over what happens on their personal device. Virtualize what the app can see and use fake data/identifiers/devices if necessary to get it to do what its supposed to. If the App isn't going to act in good faith why should the user? Fine grained permissions don't really work in practice because the app can keep annoying the user until they give in and hit Allow.
pyaamb 7 hours ago||
Also perhaps AI agents are now capable enough to run these apps the way the user would and recognize these dark patterns. Flag those and feed it back to a warning at the point of sale that users can upvote there to signal their disapproval and a threshold score that risks removal of the app from the store. Because bad behaviour continues to make business sense if the rules allow it. Moreover, it penalizes and puts pressure on the good actors as a "missed business opportunity".
mywittyname 54 minutes ago||
Maybe just have Claude rebuild the app in a non-scummy way. Analyze the site for the relevant data APIs, while avoiding the tracking stuff. Maybe someone maintains an MCP for these popular websites so people can use agents on them.
ajross 8 hours ago||
What you want is basically how it works. On both phone platforms and PWAs, all permissions are visible to the user explicitly. All of them can be revoked at any time. Apps are disallowed from requesting an already-denied permission.

Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working), and obviously third party software isn't under any obligation to work without them.

But the platforms have done what the platforms can do, at the architecture side, really. The next stage is human-audited enforcement of malware, which this AliExpress nonsense might hopefully run afoul of.

xnx 8 hours ago|||
> Obviously apps can tell if they haven't been granted a permission (even if you tried to fake this, they aren't dummies and will know if it's not working),

How can they tell? For the permissions I can think of: location, filesystem, etc. it should be easy to lie/spoof.

drdexebtjl 8 hours ago|||
>Obviously apps can tell if they haven't been granted a permission

By design. This doesn’t need to be the case. It should be impossible to tell you have denied a permission.

In TFA’s case, the browser could just keep processing audio but never hook it up to a real audio sink.

victorbjorklund 7 hours ago|||
Soundd like a nightmare to build legitimate apps if you for example are building an app that uses the camera but you can’t in anyway tell that using the camera fails (because user had denied the permission 6 months ago and has no memory of it) and instead of being able to give a helpful error you are just ending up with I am guessing fake images (maybe just a black screen).
wotb 4 hours ago|||
Just because it's hard doesn't mean you shouldn't try. What about a popup saying "xyz has tried to access the camera a lot lately, continue blocking?"? Or apps can apply for set of 'core permissions' that can't be denied but are much more tightly controlled? Apple and Google are some of the biggest companies in the world, they don't deserve as much leeway as you're offering.
voakbasda 7 hours ago|||
The image could contain a message that it is disabled.
victorbjorklund 3 hours ago|||
So we must also make it impossible for an app to read any images taken inside the app itself? You can’t literally make any apps at all
StingyJelly 5 hours ago|||
Then it is detectable. Those permissions should have a third option alongside allow and block - spoof.
ajross 7 hours ago|||
That does nothing but start an arms race. Fine, audio "works" but do you get noise? Can you read back the sounds you play? No, right? It doesn't work, QED. Now the platform needs to fake the noise.

Likewise for any other hardware access you want, and most of them are harder. How do you fake local storage without storing anything? How do you fake Bluetooth access without virtualizing an entire device? Do you fake the screen dimensions to look like something else? Input latency? Where does it stop?

No, "does this work" is among the easiest questions to answer in technology. We aren't going to win this war.

drdexebtjl 3 hours ago|||
> Can you read back the sounds you play?

No, but you also can’t do that if the user approves your app’s permission to play audio, but has the volume permanently turned down to zero.

> local storage

Give the app a temporary, space-constrained store that isn’t shared with other apps.

> bluetooth

Don’t let apps access raw bluetooth signals, but instead ask the platform to display a pairing interface (possibly with a custom stylesheet), ask the platform to call you back when a specific device is in range, etc.

> screen dimensions

Not personal data.

> input latency

Fudge the numbers even when the user grants permission.

This isn’t a war, it’s just engineering for the benefit and autonomy of the user, and not the platforms’ commercial interests.

ajross 2 hours ago||
> This isn’t a war

Fingerprinting and other quasi-malware techniques being used by desirable third party software are absolutely a war, otherwise we wouldn't have this permission structure in place in the first place. And as much as you believe the contrary, Alibaba et. al. are 100% smarter than you about how to exploit these tricks and will win.

> Not personal data.

LOL

emctech 6 hours ago|||
The best you can do on the modern web is reduce your fingerprint footprint, though it comes at a cost of websites breaking from JS disabling, or local time zone anonymisation.
spicyjpeg 9 hours ago||
Browser fingerprinting can get creative at times, to say the least. eBay's WebSocket port scanner [1] and Reddit's abuse of DRM and JavaScript JIT exploits [2] from years ago are two examples of the kind of in-depth introspection you can perform completely in the background using nothing more than simple non-permission-gated APIs.

[1] https://blog.nem.ec/2020/05/24/ebay-port-scanning/

[2] https://iter.ca/post/reddit-whiteops/

emctech 9 hours ago|
Thanks for the reads
rootsudo 3 hours ago||
I’ve noticed this and on other apps too, it breaks AirPods and when background playing Spotify it’s very obvious.

Thanks for investigating! Makes sense it’s also in the taobao app on ios too.

fuzzy2 3 hours ago||
When I visit an article on a popular German tech news website, it interrupts music playback on my iPad (the website takes audio focus). I bet they do something similar.
Flow 5 hours ago||
I wonder if this is something the iOS Facebook app also does? It constantly pauses my Apple Music playing. Soooo irritating.
buildfocus 10 hours ago||
I've seen this on many many other sites as well, most notably Twitter, and lots of common modern captcha pages too. Very annoying!
jiehong 1 hour ago||
This article writing is really clean and enjoyable to read. And I learnt something.

Thank you very much.

admax88qqq 5 hours ago||
Somebody (Mozilla?) should make a browser that just proactively blocks shit like this

I’m sure some Adblock addon could do it but at the browser level would be preferred. A browser vendor that just proactively does security and “correctness” tweaks to live sites would actually be in my interests as a user

nkjoep 10 hours ago|
JS enabled by default seems every day less secure.
emctech 10 hours ago||
So many website break completely with JS disabled and you end up having to enable it half the time anyway.
ruuda 9 hours ago|||
About half of the time, when a website doesn't work with js disabled, I realize that I didn't want to see the page that badly anyway, and I close the tab.
masfuerte 9 hours ago|||
It was pretty good until about six months ago. Since then loads of sites have added a js requirement to try to stop the AI bots.
MisterTea 9 hours ago||
IMO web browser have been enabling all sorts of obnoxious behavior since before JS. One of my all time favorites were the sites that opened pop-ups in a loop faster than you could close them while an audio clip of a guy yelling "Hey everyone! I'm looking at gay porn!" You had to hit reset. Fuck the Web.
afandian 9 hours ago|||
The web around the late 90s and early 2000s had some really sketchy stuff. I think the difference is that it used to be the sleazy underbelly. Now it's accepted as mainstream.

My local 'newspaper' website is chock full of scam adverts. The print version is dignified. The website people, somehow, turn a blind eye.

And I got an advert on Youtube this week using sexually explicit language to sell pills.

Feels like standards, and expectations, have really slipped.

grishka 7 hours ago|||
Opening a popup needs JS though.
nozzlegear 5 hours ago||
Not with the new popover API.
grishka 3 hours ago||
This doesn't look like it gives websites something they couldn't do before with CSS and JS.
nozzlegear 2 hours ago||
I'm pretty sure it does but maybe I'm wrong, I had never tried to create popovers/popups using CSS. What's neat[†] about the popovers API is that it doesn't need any JS, you just write a couple of HTML attributes and voila, a popover/popup. They will run with JS disabled as well.

https://chrisburnell.com/html-can-do-that/

[†] Neat for me building things like tooltips and dropdowns into my web apps without using JS; not neat for annoying people with popups.

More comments...