upvote
Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.
reply
I had this and it turned out to be my unifi firewall block triggering a false-positive in the browser.
reply
Any chance it was a macOS prompt? Chrome needs local network permissions for WebRTC, Cast etc. even without any website accessing your local network.
reply
Chrome says "this site", no? Isn't it the tab you have in focus?

I wonder what kind of person says 'Yes' to this prompt. It gives me the heebie jeebies.

reply
pretty sure it is a way of fingerprinting your machine/network
reply
Let's hope it's as simple as that and not a malvertising campaign.
reply
Yeah, that’s always an automatic nope. No explanation of who/what is really asking or why so, no: your shit software or website can’t go snooping around on whatever network I happen to be on, whether that’s at home or at work.
reply
Something in my work's SSO / auth mechanism does this and if you click No it silently screws up the internal website you're visiting. It doesn't block you from logging in, just parts of the site don't load/work. I haven't been able to get a good answer on what the heck is going on but it's extremely annoying.
reply
ebay does this i think, someone else linked a post about port scanning
reply
I wonder if it is something firefox and chrome devs need to look at because if it is accessing the audio device surely it should be notified to the user.
reply
As I mentioned, I suspect that this is an active choice, as just displaying the icon whenever a media context exists seems much easier than inspecting the audio stream for non-zero volume media.

I can only assume that there are legitimate reasons for this as well, e.g. websites preparing/maintaining audio context for lower latency when they intermittently play audio etc.

reply
Someone else mentioned that cloudflare uses the webaudio for verification challenge, but only triggers it briefly.
reply
Ugh... Seems like we need an audio API web permission, or maybe do something like browser already do for some of the other APIs and actually require API users to actually play something or display a warning/play an annoying chime otherwise.
reply
Not just notified but blocked by default. We already have similar bocks on autoplaying video (no audio until you interact) and access to microphones and cameras ("allow access.." popups).

Every time an article like this comes out, people wonder about aliexpress instead of why their browser allows this in the first place.

reply
It does on my Firefox, I had to close their tab because it also tricks kde into thinking I'm playing audio.
reply
Thaaaaaaat explains why an open Aliexpress tab always bumps my thermals ever so slightly.
reply
It should instead trigger a little germ icon, like a virus, because it's like a virus.
reply
It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period.

Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.

reply
I do not have the Zoom app in any form installed. I'd much rather use it in the browser. When I close the tab, Zoom is gone. After the COVID era bullshit of Zoom installing a utility that gives root access to anything, I've never installed it. Luckily, all of that came out before I started using Zoom.
reply
There's a solution to both:

1. Not make web browser general-purpose runtimes for arbitrary software.

2. OS builds a general-purposes runtime that's completely sandboxed. So users can run more complex software without needing to worry about cruft being installed on their system.

Unfortunately, browser builders have decided that web browsers are #2.

reply
This issue is about audio output. Audio and video input are both behind per-site permissions.
reply
Also, people can and should go to the firefox settings > Permissions and data > Autoplay and change the Default for all websites to "Block Audio" (at least).

You can set per-hostname exceptions if you like! CTRL + I > Permissions

reply
> You can set per-hostname exceptions if you like! CTRL + I > Permissions

1. Thank you, that's very nice to know about.

2. I really wish this was exposed more directly, probably from the permissions button that is already in the address bar. I can't believe Chrome does this better.

reply
Unfortunately that still gives another data point for fingerprinting.
reply
The speaker icon would be handy but I think that it depends from both the good will of Firefox and the installed add ons. Of course if an add on blocks the audio file there is no need to display the speaker icon for that file.

To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my Android phone. It shows a number of sites. Nothing in first party and these that I must fully enable to make the site work (css, image, script, xhr)

* aliexpress.com

* ase.aliexpress.com

* it.aliexpress.com (my country two letters domain)

* umdc-global.aliexpress.com

* aidcgroup.net

* ase.aidcgroup.net

* 67372.ase.aidcgroup.net

* alibaba-inc.com

* epss.alibaba-inc.com

* alicdn.com

* ae01.alicdn.com

* assets.alicdn.com

* aliexpress-media.com

* ae-pic-a1.aliexpress-media.com

* assets.aliexpress-media.com

* aliyun.com

* acjs.aliyun.com

Scary list, right? According to google aidcroup is

> Alibaba International IPP Platform

> https://ipp.aidcgroup.net

> Alibaba International is committed to the protection of intellectual property rights. Right holders and their agents can enforce intellectual property ...

Let me add a /s to the last line

There are two more sites that I can completely block

* googlesyndication.com

* pagead2.googlesyndication.com

so even Alibaba runs ads on Google.

I did not instrument the browser like the author of the post did, so I don't know where the audio comes from. There is nothing listed in the media column of uMatrix. This does not mean that the post is inaccurate. It could be that the browser gets the audio stream from a request in one of the other categories.

uBlockOrigin blocks two of other requests.

1. https://g.alicdn.com/code/npm/@ali/gmod-pop-disclosure-code/...

and this one that I anonymize

2. https://aplus.aliexpress.com/g.gif?logtype=0&title=WebPush Permission&pre=https://it.aliexpress.com/?gatewayAdapt=glo2ita&scr=1920x1080&_p_url=https://it.aliexpress.com/wp.html&cna=<whatever cna is>&category=&aplus=&$${beacon_mini}$$=&yunid=&=&trid=<trid>&asid=<base64 stuff>$${get_sign}$$&p=1&o=linux&b=firefox153&s=1920x1080&w=gecko&ism=other&cache=<7 letters>&lver=8.15.25&jsver=aplus_std&pver=0.7.12&_pw=0&_ph=0&tag=1&stag=-1&lstag=-1&_slog=0

Probably the audio file is coming from one of the unblocked requests but my Debian laptop does not pair with my Bluetooth earpieces so I can't test it.

reply
It doesn't actually stream an audio file, the scripts generate audio at runtime using a sawtooth oscillator. It also only happens after several seconds.
reply
Thanks. So one of the downloaded scripts is generating the audio and the browser should detect it.
reply
I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue.

@FireFoxDudes You need to be addressing fingerprinting

reply
a lot of what is used for fingerprinting is also used legitimately, and a lot of sites fingerprint. so ~every site would be behind a security risk warning.

we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored

reply
How? How would a browser "know" what classifies as finger printing? Literally every piece of the engine is used for finger printing.

It can be mitigated, a bit, but I don't see how browsers can win that battle.

Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).

reply
I feel like there are two levels of fingerprinting here, and a lot of the confusion is downstream of not properly distinguishing them:

There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc.

I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.

reply
I've only encountered the latter described as fingerprinting. Which makes sense side, like fingerprints, the information is being used to uniquely identify an individual.

The former is traditional analytics and is not enough to uniquely identify an individual.

Not all analytics are as privacy invasive as fingerprinting.

reply
>The former is traditional analytics and is not enough to uniquely identify an individual

shockingly little information is required to uniquely identify someone.

"traditional analytics" (lets just say os + browser + some hardware info) is likely to be uniquely identifying when combined with just one other sparse dataset.

>Not all analytics are as privacy invasive as fingerprinting.

fingerprinting isn't a separate category of analytics. every data point can be (and often is) used for fingerprinting.

reply
Just assume any site using javascript is using it for nefarious purposes.
reply