A Firefox engineer reveals how a sneaky AliExpress web tracker messed up Bluetooth headphones

If you have ever had issues pairing your Bluetooth headphones, skipping tracks unexpectedly, or having issues switching devices while browsing AliExpress, it seems like you’re not imagining things. In fact, a script from AliExpress attempted to secretly retrieve information from users’ computers and interfere with their hardware on a much larger scale than expected.

The only reason this came to light is that a user reported that their paired Bluetooth headphones stopped playing music from their phone while AliExpress was open in the background. Even attempting to mute the browser tab did not help.

It turns out that AliExpress, much like any other large platform, was using digital fingerprinting technology to recognize and track users. In case you want to know more about fingerprinting, you can check out our detailed article on the topic. But coming back to the issue at hand, AliExpress seemingly decided to experiment with WebAudio fingerprinting in pursuit of greater personalization.

WebAudio fingerprinting allows websites to collect identifying information about a user’s device by analyzing a silent wave of sound produced in the background. This audio wave undergoes calculations in the browser and is further examined to retrieve data about the processor and graphics card on the user’s PC. Such information is then used to determine the user’s device based on the minor differences in calculating results for each individual.

In order to perform the procedure, AliExpress’s script needed to open a connection to the audio output. Although the user would not hear any sound from their speakers, the website would receive unique data from the audio output stream. Because of this, even with physical switches, Bluetooth headphones could not revert to the phone in use, as the audio stream would appear to be already open.

After the privacy threat was discovered, Firefox privacy engineer Tom Ritter responded by outlining the browser’s protection measures against such attacks. He noted how “browser fingerprinting is a far-too-pervasive method of tracking users across the web,” and that WebAudio scripts are no longer effective at achieving their goal.

With the latest versions of Firefox, WebAudio calculations are randomized, thus making it significantly harder for websites to access them in order to collect identifying information.

More recently, we also highlighted how Firefox is working on a new security feature that will block extensions from running on certain sensitive websites. Measures like these show the importance of picking the right browser. And if you’re looking for a new privacy-focused browser, we recommend giving this report a read.

We stand out from the tech-media crowd because we break news stories; we mainly bring you stuff that you won’t find anywhere in the mainstream tech media. Our stories have been picked up by some of the world’s most popular websites and media outlets—more info is available here.