🤖 AI Summary
AliExpressはユーザーの音響システムを利用し、指紋認証を行う手法を採用していることが明らかになりました。開発者の「laserphile」によると、アリエクスプレスのサイトがWebAudio APIを使用して、不可聴の音声信号を放送し、それぞれのデバイスが信号を処理する微妙な違いを測定することで、ユーザーを特定する独自の指紋を作成しているとのこと。Bluetoothヘッドフォンが一時的に停止することや、画面サイズやネットワークデータなど、幅広い情報も収集されていると報告されています。
この手法は不可視かつ非同意で行われており、プライバシーに重大な影響を及ぼします。開発者は問題を解決するためにはプライバシーオリエンテッドのブラウザを使用することを推奨しています。FirefoxやBraveといったブラウザでは、この種の追跡を制限またはブロックすることが可能です。
要するに、AliExpressはユーザーのデバイス情報を無断で収集し、指紋化することでトラッキングを行っているという点が本記事の主な内容です。
A developer says AliExpress is using the browser's WebAudio API to help fingerprint users by playing inaudible audio and measuring tiny differences in how their devices process it. CyberNews reports: The developer, "laserphile," wrote on their blog that they recently ran into some weird issues with their Bluetooth headphones. They couldn't play music via their phone when, at the same time, the AliExpress website was open on their PC. The headphones, laserphile explained, support multipoint Bluetooth audio so they can be connected to the PC and phone at the same time, for instance, playing music on the phone and announcing notifications through the PC. "Shortly after loading the AliExpress homepage, audio from my phone would stop playing. Closing the AliExpress tab fixes it immediately," the developer said in the blog post.
"Muting the tab/Firefox/Windows does not help, and there is no visible video, music, or other media playing on the page. This seemed suspicious enough to investigate." It turns out that Alibaba has been secretly leveraging AliExpress users' audio systems to track them and build detailed fingerprints of them. [...] The AliExpress site was using the browser's WebAudio API to run invisible sound waves at zero volume. By measuring tiny hardware differences in how each PC processed those signals, the site created a unique digital fingerprint to track devices -- without user knowledge or consent.
The secret audio path froze the developer's Bluetooth connection while covertly scraping hardware memory, screen dimensions, and network data in the background. The data collection extends beyond audio. Further inspection revealed that the same scripts also measure canvas, WebGL, hardware specs, WebRTC, mouse/touch events, and automation indicators. All of these form a broad device fingerprint that is sent back to Alibaba's telemetry servers. The simplest fix is to use a privacy-focused browser such as Firefox or Brave, which can limit or block this kind of fingerprinting. Brave goes further by randomizing fingerprint data and blocking the AliExpress tracking scripts involved.
Read more of this story at Slashdot.
ログイン
