Alibaba is facing scrutiny over its use of WebAudio fingerprinting, a browser-tracking technique that can help distinguish users by measuring subtle differences in how their devices process audio.
The technique attracted attention after fingerprinting code running on Alibaba reportedly caused an unexpected interaction with a user’s Bluetooth headphones. Tom Ritter, one of Firefox’s lead privacy engineers, subsequently examined the code and published an analysis yesterday, showing that the browser’s protections are effective against this tracking method.
Browser fingerprinting differs from traditional cookie-based tracking because it does not necessarily require storing an identifier on a user’s device. Instead, scripts can collect characteristics exposed by the browser and hardware and combine them into a profile that may be sufficiently distinctive to recognize the same device later.
WebAudio fingerprinting uses the browser’s audio-processing capabilities for this purpose. A script can generate or process audio internally and examine the resulting numerical output. Small differences in how CPUs and browsers perform those calculations can reveal information about the underlying system.
Alibaba is one of the world’s largest technology companies and operates major e-commerce, cloud computing, logistics, and other online services. The presence of fingerprinting code on its services is notable because of the scale at which such tracking techniques can potentially be deployed.
In this case, the more unusual aspect was that the fingerprinting process apparently became visible to the user by affecting Bluetooth audio hardware. Ritter pointed to the incident as an example of how tracking code designed to operate silently can eventually produce an unexpected side effect when executed across enough different devices and configurations.
His analysis also showed that the information Alibaba was attempting to obtain through WebAudio may not be particularly useful against modern Firefox installations.
Mozilla introduced changes in Firefox 118 designed to make WebAudio calculations more consistent between users. According to telemetry cited by Ritter, more than 99% of Firefox users now fall into only a handful of common WebAudio results rather than producing highly individualized values.
The remaining differences are largely associated with broad processor characteristics. Systems using different CPU architectures or mathematical instruction sets can still produce slightly different results because audio processing involves floating-point calculations that are not always identical across hardware.
That may allow a fingerprinting script to infer some general information about a device, such as whether it belongs to a broad x86 or ARM hardware group, but it is substantially less useful than obtaining a value unique to a particular computer.
A small number of Firefox systems still produced unusual WebAudio results. Ritter said those outliers could stem from uncommon processor architectures, hardware quirks, faulty memory, or other unusual system behavior. Such cases could potentially make individual users more distinctive, but they represent only a tiny fraction of the measured population.
Users should remember that WebAudio is only one of many signals available to tracking scripts. Websites can combine details about graphics hardware, screen configuration, installed fonts, browser behavior, operating system characteristics, and numerous other properties to create a much stronger fingerprint. Hence, browser-level anti-fingerprinting protections are key, and relying solely on blocking cookies is not enough.
Leave a Reply