This paper details the discovery and analysis of a technique known as "Audio Fingerprinting" used by websites, specifically AliExpress, to track user devices without explicit consent.

Core Discovery

A developer noticed that their Bluetooth headphones would intermittently disconnect or experience audio interruptions when accessing the AliExpress website. Through investigation, they discovered that the website was executing hidden scripts that accessed the browser's Web Audio API, even though no audible media was playing.

Methodology: Audio Fingerprinting

The tracking mechanism utilizes the AudioContext interface in the Web Audio API to generate a unique "fingerprint" of the user's hardware. The process follows these technical steps:

1. Signal Generation: The script initiates an OscillatorNode, typically creating a sawtooth wave ($f(t) = A \cdot (\frac{t}{T} - \lfloor \frac{t}{T} + \frac{1}{2} \rfloor)$).
2. Analysis: The signal is passed through an AnalyserNode, which processes the waveform.
3. Hardware Interaction: Because the audio processing occurs at the hardware/driver level, the resulting signal is subject to the unique characteristics of the user's CPU architecture, audio drivers, and browser environment. These create infinitesimal variations in the output (noise).
4. Data Extraction: The result is serialized, encrypted, and transmitted to a remote server.
5. Identification: By comparing these unique hardware noise profiles against a database, the server can identify and track specific users even if they clear their cookies or use "Incognito" mode.

Technical Defense and Mitigation

The paper discusses how browsers mitigate this surveillance:

• Firefox: Implements a protective measure where AudioContext outputs are "constantized." By forcing the audio output values to a uniform set of constants regardless of hardware, the browser effectively masks the unique hardware signature, rendering the fingerprinting useless.
• Brave: Employs aggressive script blocking to prevent known tracking libraries (e.g., collina.js) from executing entirely, alongside hardware-level noise injection to prevent GPU/CPU fingerprinting.
• Chrome/Google: The paper posits that Chrome offers minimal protection against these techniques, noting that Google's core business model—online advertising—incentivizes tracking, making the integration of robust fingerprinting defenses difficult.

Ethical and Practical Implications

The paper categorizes this practice as an "industry standard" for anti-bot measures (replacing intrusive CAPTCHAs), yet highlights three major concerns:

1. Scope: Data collection occurs automatically upon page entry, far exceeding the scope of necessary security checks.
2. Obfuscation: The use of heavily obfuscated code suggests an intent to hide surveillance from the user.
3. Lack of Transparency: Unlike cookies or login credentials, which users knowingly provide, fingerprinting harvests system metadata (OS, CPU, GPU, browser version) without explicit disclosure.

The author concludes that there is an inherent trade-off in modern web browsing: high convenience often comes at the cost of personal privacy ("No Privacy, High Convenience"), suggesting that users must weigh their preference for seamless browsing against the loss of their digital anonymity.