Browser Fingerprinting and the Web Audio Technique
In the world of online privacy, browser fingerprinting has emerged as a prominent technique that allows websites to identify and track users without relying on traditional cookies. One specific method that has come under scrutiny involves leveraging audio soundprinting—which takes advantage of variabilities in math libraries used by browsers to render audio. This approach has the potential to create a wide array of unique signatures based on a user’s CPU and other system differences.
As awareness of this technique grew, Firefox implemented a significant change in 2023 with the release of version 118. According to Tom Ritter, a Firefox developer who also contributes to the Tor Project, the browser began using its own unique math libraries instead of those provided by the operating system. This crucial modification drastically reduced the entropy of audio signatures, effectively neutralizing the soundprinting technique.
Interestingly, this method is also ineffective in Google Chrome for similar reasons, as the browser employs its proprietary libraries. Users of Safari are likely safe as well, although Apple has yet to officially confirm this. The overarching trend indicates that major browser developers are increasingly taking steps to fortify user privacy.
An Outdated Approach: A Case Study of AliExpress
Amidst these advancements, AliExpress has recently been spotlighted for utilizing an outdated fingerprinting method involving audio. This raises an essential question: why continue employing a technique that has largely been obsoleted by modern browser security measures? The likely answer lies in the retailer’s adoption of numerous other fingerprinting strategies that operate in tandem.
According to insights from Callaghan, AliExpress utilizes a multitude of fingerprinting methods, including:
- Canvas rendering and toDataURL()
- WebGL renderer information, extensions, and shader precision
- Audio oscillator and analyzer output
- Screen and viewport dimensions
- Device pixel ratio
- Hardware concurrency and device memory
- Installed browser plugins
- Supported audio and video formats
- WebRTC behavior
- Browser performance timing
- Mouse, touch, focus, and scroll events
- Device motion and orientation
- Properties commonly associated with browser automation
This revelation suggests that the web audio trick might be a remnant from earlier days of less stringent privacy controls, overlooked until now. While it’s reassuring that browsers are actively working to protect users, the landscape remains unsettling. Many websites, it seems, have yet to adopt the latest privacy-preserving measures, raising the prospect that numerous sites may be leveraging similar techniques to track users.
As browser developers engage in a continual battle of innovation against site publishers, who are perpetually probing for new methods to sidestep protection mechanisms, maintaining privacy online becomes increasingly complex. For now, it’s prudent for users to stay informed about the various tracking techniques employed by online services.
For further reading, you can explore more about these developments Here.
Image Credit: arstechnica.com
