@midudev: AliExpress has a nearly invisible way of identifying you. How? By using the audio from your PC. 1. You open the website…
Miguel Ángel Durán
@midudev
AliExpress has a nearly invisible way of identifying you. How? By using the audio from your PC.
1. You open the website → the music on your phone cuts out.
There's no <audio> or <video>. Muting the tab doesn't help. So what's going on?
2. They're generating a sound with JavaScript:
You don't hear anything: the volume goes to 0.
But it does get sent to the speakers.
The PC thinks there's audio.
The headphones get stuck and don't switch to the phone.
They use that sound to identify you.
Every CPU and browser processes the audio just a tiny bit differently.
And that, along with canvas, WebGL, and more, is your fingerprint.
Firefox already makes the audio part almost useless.
The Bluetooth trick… still works.
The original post (and the uBlock filter):
→
💬 80 · 🔁 482 · ❤️ 4.5K · 👁 436.2K
9:05 PM · Aug 22, 2026 · View on X
Thread (1 more)
Miguel Ángel Durán @midudev
On AliExpress from Spain, it does load the audio processing code in a file that is heavily encrypted.
It's possible that they do this to prevent fraud or as an anti-bot system, but the level of footprint it creates is quite...
Replies (74)
Oscar Blue Team @oscarblue_team
In fact, Firefox detected it and protected the user.
Miguel Ángel Durán @midudev author
I mention it at the end of the post! Although on Hacker News they were commenting that there's still something that needs to be disabled.
Petacreepers23 @Pcreepers
it looks like they've slipped you a virus as big as a cathedral
Miguel Ángel Durán @midudev author
But dude, you're a computer engineer, show a bit of rigor. 😂
Camaleón Raro @camale0nrar0
AudioContext fingerprinting is a headache in headless scrapers.
Disabling the Web Audio API triggers captchas for you. The solution was to add noise ±0.0001 dB to the samples.
Have you tried if it also cuts the buffer in Firefox or does it only happen in Chromium?
Joaquin Cartagena @Joaquin_888
It seems fine to me; impersonation through cookies is at levels never seen before. Cybersecurity must evolve, or we'll all end up hacked.
Bussio28Team | Cybersecurity @Bussio28Team
Interesting technique. Web fingerprinting continues to evolve far beyond cookies: audio, canvas, WebGL, fonts, hardware...
What's concerning isn't just the technology, but how much the user really knows about these identification techniques.
Privacy by design should be the
Joshua_a @_El_Ing
Sorry, and is this good or is it bad?
Orlando Delgado @orlandelgado
That is an attack on user privacy.
Anyer Andara Senior PHP/WP Eng. | APIs Críticas @aandaradev
That's what's great about using Brave
PaintFloid @real_paintfloid
That's why I use Brave, you can block the use of fingerprints
Emiliano Blasco (FLG) @Blascotico
about:config --> privacy.resistFingerprinting = Strict (activa) en firefox.
Nelson Graña @NelsonGraa8
It pains me a lot to say it, but this world has changed so much that Firefox is becoming the new Internet Explorer. 😓
Jose Luis Guerra @JLGuerraInfante
We'll have to come up with something to obscure it. It doesn't seem too complicated to me.
veus @ElmasMarq
rudimentary trick that the browser or JavaScript maintainers don't patch, hmm, just a matter of thinking
PETROMÓVIL @criptonooblatam
That's why I use Firefox, even though it's still trendy to use the Chromium flavors
Dakaeras @Dakaeras
Lo fill de Tarsan @Ximer35
The question that comes to mind is, if they do this with web navigation, what should the app be like?
Iván @ivangraupera
It's unbelievable the level of spying there is on the internet. Before, companies focused on selling you products and services that interested you; now they focus on worldwide mass surveillance. No one is safe. Everyone wants to deceive you and take advantage of you.
Being a
Pepe @Pistoleriush
I don't give a damn; since the tariffs, I haven't asked Ali for anything again.
Manuel Montiel @ManuelMontielMX
Inches chinos! They're replicating the idea of the Israeli hack on the Iranian centrifuges. These bastards are geniuses.
Alan Daitch @AlanDaitch
Wow
AI botter @BotterAi16146
all this analysis - while the junior dev who pushed a shitty code be like - WHATTTT
ohd_logs @ohd_logs
Another neat way to identify you is to use your login information, they could probably use your shipping address too.
Hamza HAMIDI @hamzahamidii
Omg the number of idiots who don't understand a thing about fingerprinting in web. The way you wrote your post is also misleading and screams conspiracy. Idiot!
John Redmond @099John
Lockdown mode on iOS just spits in the face of this
ShadowAguy @shadowaguy
i thought ad tracking was done; apparently my speakers are informants.
No XaT @dokustore43252
midu y lo peor es que no creo que sea ilegal porque min debe esatr en la parte mas profundaa de sus terminos y condiciones
fish4terrisa-MSDSM @flyingfish2662
AliExpress is from china so what do u expect lol
ArmadaRED1 @ArmadaRed1
Ебаные коммунисты.
Sin Jeong-hun @realrealcat
Ever since the RAM/SSD prices spiked and KRW value plummeted there is nothing to buy on AliExpress for me.
VC Intern @the_vc_intern
A Bluetooth bug exposed how AliExpress checks visitors for fraud before they even log in.
A developer noticed his multipoint headphones stopped switching from his computer to his phone whenever an AliExpress tab was open. Closing the tab fixed it immediately. Muting the tab, x.com/brave/status/2…
lan @lanxiuying
AliExpress boss: Your program has a problem, fix it quickly, don't let it affect the advertising and revenue departments!
carlos @carlupiter
Tremendo
Aleksandr "M.O.Z.G" Dikov @M_O_Z_G
Firefox has a lot of good tools to spoof fingerprints. So, we can have different IDs in each container in one browsers.
CanvaBlocker + Font Fingerprint Defender + AudioContext Fingerprint Defender + Different proxies for each container + WebRTC disabled + Language Switch.
Mattel @creatine_queen
ever heard of ad blockers
Aristides Aleman @AlemanA56708
I can't even shop in peace
Matías Matthews @MatiasMatthews
What's disturbing is that no single signal needs to be perfect. Audio, canvas, WebGL, and behavior become an identifier when combined. The problem isn't this specific trick, but how many small differences the browser continues to expose.
Aiixi Bear @aiixi_bear
@grok 用中文解釋一下，我不太懂
Tommy @wor_tom
And what if I don't have speakers?
nivelepsilon @FpeSre
The Bluetooth thing isn't about the fingerprint's price, it's the price of something else. The AudioContext can be calculated in offline mode, without touching the sound card or the output device, so the fingerprinting would work the same way without hijacking your headphones. If
Hayden @dyd4dsh7
Time for @brave to add something for this.
carapato @_carapato
AliExpress te identifica con tu usuario y contraseña. No inventes.
Denilson @denilpe
Whaaaat, nothing can be understood with that writing!!!!
Ruby @Whattheamong
@uwukko is this possible with Helium?
Bryan @Bryan90162016
@brave 🤔
Rami The Paladin @RamiThePaladin
Only idiots buy off that scam site. They deserve being tracked.
Hosenur @hosenurrh
@grok how does this identify me
Colton Dowell @ColtonDowe
This shit happens on twitter too when listening on headphones
dduran @dduran4
Chinos espiando, que raro
Gene @BushCoderZA
Use Brave
Fanisus @Ferrb9579
@brave help
Jesus M. Velasco @jesusrobot_
El diabloo
Buswe @buswe_com
That trick is AudioContext fingerprinting: it measures how your hardware processes a waveform and spits out a stable ID even if you clear your cookies.
Marce @chocolateajiad
mal explicado, no entendi nada
FranciscO1989 @FranciscoUtiiel
Brave y punto
Andrei Cosmin @CAndreiCosmin
I think they can identify me when I press the "login" button too...
Amado Martinez @sorrus
Que abuso
HAL-1 @PaitOOn1
Er, where's the uBlock filter?
ΛNGΞL @marthaelax
Muy ingenioso
Affliction @vindication_73
I didn't understand a fucking thing of what you said
darknessblade @darknessblades
No wonder it says "Suspicious behavior detected" if you use a adblocker when visiting a store's landing page.
It tries to load the script but fails because Ublock Origin detects and blocks it
Sorbus @sorbusCobPhiil
I don't know how this benefits Shanghai, but oh well, enjoy the devalued stuff.
Buggy @CsBuggy
yo @uwukko can u patch this for helium so i finally have an excuse to switch from brave
Andrew Nosenko @noseratio
@grok how to track this in Chrome?
bitcoinvaccine @bitcoinvaccine
탭 음소거해도 소용없다는 게 더 무섭네요
𝐅𝐢𝐫𝐞𝐧𝐧 @awildFirenn
Pero no entiendo, que seria lo que trackean? que sos un humano de verdad?`
FriedMuffin @FriedMuffin9000
@brave what about you?
Filipe Dória @FilipeDoria1020
Como te identificam?
Gold Byte @Gold_Byte
Estas películas solo te pasan a ti.
Coco Encendido @cocoencendido
👀
Gabriel Garcia @gabrielalej
@teslanacho solo los genios hacen esto 🛸
Betonowe Złoto ® @BetonoweZloto
Ale ich samochody i roboty na pewno nie szpiegują w naszym kraju ;)
Vítor - e/acc @VitorProDev
Una barbaridad
Comments (0)
No comments yet