The Web Audio API has the ability to extract frequency, waveform, and other data from an audio source, that source is generated at runtime on your device. A firefox developer did a further dive into what the WebAudio based fingerprinting can actually return in firefox. https://developer.mozilla.org/en-US/docs/Web/API/AnalyserNod...
While it may not be effective at fingerprinting, the side effect of the attempt sure is annoying when it stops my music! Do you know if it would count as a bug if muting the firefox tab or the browser as a whole does not stop the audio stream?
I doubt the FBI will be flying to china to knock down any doors!
You aren't wrong though, and countries which enforce GDPR I would expect to make noise if this was happening to their constituents.
Thanks for your input and perspective! Do you think it is a bug that the muting of the firefox tab doesn't stop the audio stream?
It is frustrating that companies would use such an annoying tactic to track their users with it also ineffective.
I touched on this in my article, once the data has been collected and sent to their servers you have no idea what they do with the information. At least with GDPR it is supposed to be regulated but obviously that is not the case everywhere and websites can still lie.
It doesn't actually stream an audio file, the scripts generate audio at runtime using a sawtooth oscillator. It also only happens after several seconds.
I wonder if it is something firefox and chrome devs need to look at because if it is accessing the audio device surely it should be notified to the user.
The best you can do on the modern web is reduce your fingerprint footprint, though it comes at a cost of websites breaking from JS disabling, or local time zone anonymisation.
I use ublock origin and by default it wasn't blocking, i had to make a custom filter to block the scripts in order for it to prevent the audio takeover. Maybe adguard does a better job? Someone else suggested just wholesale disabling of JS but it is the nuclear option.
The script generates a known waveform, it is passed through the browser's audio implementation and then the script analyses the result after. Based on your devices settings and hardware the output will be different, e.g. a PC with analog output might have 44KHz audio output bandwidth, but a bluetooth headset might have a lower, different audio bandwidth. That is a datapoint that can be used in device fingerprinting alongside screen and viewport dimensions,
device pixel ratio, browser plugins, etc.
Yes, I find it concerning too. I particularly dislike that windows was not aware, nor could it stop the audio stream from effecting the hardware. What other side channels like that exist? Perhaps I can be blamed for using windows
Recently I ran into a problem with my Bluetooth headphones. They support multipoint bluetooth audio, so they can be connected to my PC and phone at the same time.
Opening the Aliexpress webpage causes a silent audio stream keeping the PC>headphone link active blocking my phone audio.
An investigation reveals obfuscated code running device fingerprinting with a side effect being a silent audio stream that firefox, chrome and windows does not recognise but which kept the bluetooth connection active.