In the past, differences between the mathematics libraries used by web browsers to generate audio were significant enough to create highly distinctive browser and device fingerprints. When combined with variations in CPUs and other hardware, these differences could produce a large number of unique signatures. After audio fingerprinting became widely known, Firefox introduced a mitigation in 2016. By version 118, released in 2023, and following subsequent changes, browsers began using their own standardized mathematics libraries instead of relying on libraries provided by the operating system. Tom Ritter, a Firefox developer and Tor Project volunteer, said that using consistent libraries reduced the technique’s identifying information to the point that audio fingerprinting was no longer effective.
A Google spokesperson said the technique does not work in Chrome because Chrome ships with its own mathematics libraries. Safari users are also likely protected for the same reason, although Apple did not immediately confirm this.
Outdated browser fingerprinting techniques
AliExpress’s use of an outdated audio fingerprinting method raises an important question: why is the technique still being used? One possible explanation is that it may be just one of roughly a dozen browser fingerprinting methods used by online retailers. Callahan said other tracking techniques include:
- Canvas rendering and the toDataURL() method
- WebGL renderer information, extensions, and shader accuracy
- Audio oscillator and analyzer output
- Screen resolution and viewport dimensions
- Device pixel ratio
- Hardware concurrency and device memory
- Installed browser plugins
- Supported audio and video formats
- WebRTC behavior
- Browser performance timing
- Mouse, touch, focus, and scrolling events
- Device movement and orientation
- Properties commonly associated with browser automation
The Web Audio fingerprinting technique may simply be a relic from several years ago that remained unnoticed until now.
It is encouraging that browser manufacturers have introduced protections against audio fingerprinting and other tracking methods. However, the effectiveness of the remaining metrics used by AliExpress is still unclear. The issue is broader than one retailer: thousands of websites may use similar browser fingerprinting techniques. Browser developers continue to compete with publishers and advertisers that are constantly searching for new ways to identify users and bypass modern privacy protections.
Source: arstechnica.com