A researcher discovered a hidden mechanism on the AliExpress website: the page generates an inaudible audio signal and analyzes how it is processed by the computer's audio subsystem. This isn't eavesdropping or microphone recording—it's an internal test signal that reveals the device's hardware and software features.
How it was discovered. The key indicator was the behavior of Bluetooth headphones: while the AliExpress tab was open, the headphones couldn't automatically switch from the computer to the connected phone. This occurred because the computer continued to be considered the active audio source. After closing the tab, the problem disappeared.
Why might this be necessary? This method could serve as an additional fingerprinting tool: if the user revisits the site from the same computer, the site could recognize them based on their audio processing characteristics.
It's important to note that there's no evidence yet that this data is actually used to track specific users. Nevertheless, the very existence of such a mechanism raises questions about the transparency of web tracking and the limits of technical checks on websites.
For the industry, this is yet another example of how device identification is moving beyond traditional cookies: websites are using indirect indicators, from fonts and screen resolution to audio system characteristics. With privacy regulations tightening, such methods are becoming increasingly visible, and their detection is a crucial part of the work of security researchers.
