Alibaba’s online shop AliExpress has apparently been tracking its customers without them noticing. Scripts are apparently executed on its site that generate inaudible audio signals in the background. Since these are processed slightly differently on each device, they make website users recognizable – completely without cookies.
The practice was uncovered by chance: A developer noticed problems with his multipoint Bluetooth headphones as long as an AliExpress tab was open. As TechSpot reports, the headphones no longer switched correctly between the computer and smartphone. As soon as the AliExpress tab was closed, the problem disappeared. When analyzing the source code, the developer came across scripts that build audio processing graphs via the Web Audio API.
These scripts generate an identical audio signal for each user and then measure tiny differences in the way different devices processed this signal. These deviations result from the interplay of the processor, sound chip, drivers, operating system, and browser implementation, the combination of which is slightly different for each device. This creates a kind of digital fingerprint that can make a device recognizable over longer periods – without cookies having to be set.
