What's this about?
The investigation began as a hardware annoyance. Someone's Bluetooth headphones support multipoint — connected to PC and phone simultaneously — and opening the AliExpress webpage caused a silent audio stream that kept the PC-to-headphone link active, blocking phone audio. Digging in revealed WebAudio fingerprinting. Others reported the same from the iOS app: a backgrounded AliExpress made car audio behave as though a voice command were being issued.
What exactly is WebAudio fingerprinting?
Browsers include an audio-processing API for generating and manipulating sound. A site can use it to produce a tone you never hear, run it through some processing, and measure the exact numerical output. That output varies subtly with your hardware and software stack — audio drivers, processor, floating-point behaviour — so the result acts as a stable identifier for your device. It works without permissions, because playing sound has never been treated as sensitive. The Bluetooth breakage is incidental: the silent stream is a side effect that happened to be audible in its consequences, which is the only reason anyone noticed.
What's the community saying?
- "Audio should be permission-gated like camera and microphone." The thread's main proposal, with the honest counterpoint that most users would grant it anyway since sites have videos.
- Multiple independent confirmations arrived, including someone whose car audio kept misinterpreting a backgrounded AliExpress app as a voice command, and someone who had noticed months ago and assumed fingerprinting without proof.
- A genuine technical question the thread wanted answered: what exactly is being sampled if nothing is audible? The answer — that the measurement is of processing output, not of sound — is not obvious.
- The practical outcome: several urged the author to submit the blocking filter upstream to uBlock's lists, which is how this kind of finding turns into a fix.