DIGITAL LIFE

How AliExpress monitors you while you simply browse the site

Online shopping seems like a simple activity: open the site, search for a product, and eventually complete the purchase. But behind this experience, modern web pages can observe an impressive number of technical characteristics of your device. Screen specs, graphics, memory, the browser, and even the behavior of specific APIs can reveal information. In the case of AliExpress, an investigation uncovered an additional element in this data collection process—one involving something we usually don't even notice while browsing.

Strange behavior caught his attention...The issue came to light almost by chance when Matthew Callaghan, a software engineer and hardware specialist, noticed his multipoint Bluetooth headphones behaving unusually.

Normally, the headphones could stay connected to both his computer and mobile phone simultaneously. However, whenever Callaghan opened AliExpress in Firefox or Chrome, the audio playing from his phone would stop reaching the headphones.

The problem would vanish as soon as the site's tab was closed.

There was also a particularly curious detail: there was no music, video, or visible multimedia content playing on AliExpress.

Callaghan then began investigating what was happening behind the scenes. Muting the tab didn't solve it. Even muting the browser or Windows itself failed to stop the behavior.

His analysis eventually pointed to scripts running on the page and to a technology that, under normal circumstances, is associated with in-browser audio applications.

That was the moment the site's seemingly mundane operation began to reveal something far more interesting.

The browser was processing a signal that no one could hear... According to the investigation, scripts identified as `collina.js` and `fireyejs.js` were creating `AudioContext` objects using the Web Audio API.

These scripts apparently generated a known audio wave and analyzed how the browser processed that information. The result could then serve as yet another technical characteristic used to identify a specific environment.

The detail that makes this discovery especially intriguing is that the audio didn't need to be audible to fulfill this function. After processing, the signal was sent to the audio output with the gain set to zero. In practice, this meant the user should hear absolutely nothing.

Even so, the activity was enough to interfere with the operation of Callaghan’s Bluetooth headphones. Ironically, this very side effect ended up exposing an operation that was meant to go unnoticed.

The technique is related to so-called "browser fingerprinting." The idea isn't to capture a physical fingerprint, but to gather various technical characteristics capable of distinguishing one device from another.

And the audio was just a small part of the story.

The fingerprint involved much more than just audio...The investigation indicated that the analyzed scripts also checked a range of other characteristics of the browsing environment.

These included information related to Canvas and WebGL, screen dimensions, available memory, compatibility with various multimedia formats, WebRTC, processing times, and specific user interactions.

Individually, much of this information might seem insignificant. The issue—or the utility, depending on your perspective—arises when several of these data points are combined.

Together, these characteristics can create a highly specific technical profile, making it possible to distinguish between different browsers and devices.

The scripts identified during the analysis appear to be linked to AWSC, and Callaghan believes they may be associated with security and abuse-prevention mechanisms used by Alibaba.

AliExpress's privacy policy already provides for the automatic collection of certain technical information and data related to service usage. However, this does not mean the company specifically disclosed this Web Audio experiment, nor does it allow us to determine how that information would subsequently be used.

Furthermore, based on available data, there is insufficient evidence to claim that the system was used to personally identify users or that it violated any laws.

Chrome and Firefox have already made this type of tracking more difficult...There is also an important caveat. The mere fact that a webpage performs an audio analysis does not necessarily mean it can identify a browser with high precision.

Firefox and Chrome have been adopting measures to reduce precisely this type of variation between devices.

In Firefox, changes implemented starting with version 118—released in 2023—have made the results produced by the Web Audio API much more uniform. Data cited by developer Tom Ritter indicates that 99.24% of measurements fall into just three result categories.

Google also states that measures incorporated into Chrome make this specific method ineffective for fingerprinting.

Even so, the discovery is significant because it demonstrates how a webpage can exploit technical characteristics that typically remain completely imperceptible to the user.

The most intriguing question, therefore, is not merely whether invisible audio can accurately identify someone. It is realizing just how much information a modern browser can reveal while everything appears to be proceeding normally.

In the case of AliExpress, it took only a few Bluetooth headphones behaving strangely to turn a virtually invisible activity into a concrete clue.

And that is perhaps the most curious aspect of the entire story: while the user was simply browsing an online store, their own equipment ended up revealing what was happening behind the scenes.

mundophone