AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

A user's frustrating experience with multipoint Bluetooth headphones led to a surprising discovery: AliExpress was silently running WebAudio-based fingerprinting scripts that interfered with their audio setup. This deep dive uncovers a sophisticated, hidden tracking mechanism employed by the e-commerce giant.

• The author noticed their Bluetooth headphones, connected to both a PC and phone, would remain active on the PC when an AliExpress tab was open, preventing phone audio.
• Standard checks for media elements or active audio playback yielded nothing; the issue occurred after the page sat idle and persisted even with tab muting.
• Instrumentation revealed two hidden AudioContext objects created by highly obfuscated scripts (collina.js, fireyejs.js) from Alibaba's anti-abuse tooling.
• These scripts construct a WebAudio graph that generates a waveform, analyzes its output (which varies across devices/browsers), and connects it to the audio destination with zero gain, making it inaudible but active.
• This WebAudio activity is part of a much broader device fingerprinting effort, collecting data on canvas, WebGL, hardware, and user interaction, likely for fraud detection, bot prevention, and user tracking.
• The author provided specific uBlock Origin rules to block these scripts, though blocking them might trigger more CAPTCHAs due to their connection to anti-fraud systems.
• Concerns highlighted include the hidden nature, broad data collection, the deliberate obfuscation, and the real-world hardware interference that bypasses standard browser controls.

Ultimately, this investigation exposes the lengths to which some sites go for device identification, raising serious questions about browser security, user privacy, and the unexpected physical side effects of silent web activities.