Brave Discloses AliExpress Uses Silent Sound Waves to Fingerprint User Devices

A San Francisco developer has discovered that AliExpress, the cross-border e-commerce platform under Alibaba Group, plays inaudible sound waves at zero volume on users' computers through hidden browser scripts to generate device fingerprints and track users. The practice does not rely on traditional cookie technology but instead identifies users by exploiting subtle differences in devices' audio processing systems.

According to information disclosed by Brave, the tracking method exploits the browser's Web Audio API to process audio signals at zero volume. Because computers differ in hardware and software configurations such as CPU, sound card, and browser, each device produces subtle variations when processing the same audio file. By measuring these variations and combining them into a unique audio fingerprint, the website can identify a user's device even after cookies are deleted or blocked.

The discovery came about by accident. The developer's Bluetooth headphones were unable to switch the audio connection from the computer to a phone because the AliExpress page was playing silent sound waves, occupying the headphones' audio channel. Further inspection of the website's code revealed that background scripts continuously maintained access to the computer's audio processing system. In addition, the scripts also collected other identifying data, including available device memory, screen size, and network information.

Brave said its browser has blocked audio fingerprinting and other types of fingerprint tracking by default for more than six years. The browser injects random information into output data so that different websites see different device fingerprints, and the fingerprint resets after each session. Brave also said it has recently added defenses against GPU fingerprinting to prevent websites from identifying user devices through graphics card or driver information.