I wonder what kind of person says 'Yes' to this prompt. It gives me the heebie jeebies.
I can only assume that there are legitimate reasons for this as well, e.g. websites preparing/maintaining audio context for lower latency when they intermittently play audio etc.
Every time an article like this comes out, people wonder about aliexpress instead of why their browser allows this in the first place.
Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.
1. Not make web browser general-purpose runtimes for arbitrary software.
2. OS builds a general-purposes runtime that's completely sandboxed. So users can run more complex software without needing to worry about cruft being installed on their system.
Unfortunately, browser builders have decided that web browsers are #2.
You can set per-hostname exceptions if you like! CTRL + I > Permissions
1. Thank you, that's very nice to know about.
2. I really wish this was exposed more directly, probably from the permissions button that is already in the address bar. I can't believe Chrome does this better.
To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my Android phone. It shows a number of sites. Nothing in first party and these that I must fully enable to make the site work (css, image, script, xhr)
* aliexpress.com
* ase.aliexpress.com
* it.aliexpress.com (my country two letters domain)
* umdc-global.aliexpress.com
* aidcgroup.net
* ase.aidcgroup.net
* 67372.ase.aidcgroup.net
* alibaba-inc.com
* epss.alibaba-inc.com
* alicdn.com
* ae01.alicdn.com
* assets.alicdn.com
* aliexpress-media.com
* ae-pic-a1.aliexpress-media.com
* assets.aliexpress-media.com
* aliyun.com
* acjs.aliyun.com
Scary list, right? According to google aidcroup is
> Alibaba International IPP Platform
> Alibaba International is committed to the protection of intellectual property rights. Right holders and their agents can enforce intellectual property ...
Let me add a /s to the last line
There are two more sites that I can completely block
* googlesyndication.com
* pagead2.googlesyndication.com
so even Alibaba runs ads on Google.
I did not instrument the browser like the author of the post did, so I don't know where the audio comes from. There is nothing listed in the media column of uMatrix. This does not mean that the post is inaccurate. It could be that the browser gets the audio stream from a request in one of the other categories.
uBlockOrigin blocks two of other requests.
1. https://g.alicdn.com/code/npm/@ali/gmod-pop-disclosure-code/...
and this one that I anonymize
2. https://aplus.aliexpress.com/g.gif?logtype=0&title=WebPush Permission&pre=https://it.aliexpress.com/?gatewayAdapt=glo2ita&scr=1920x1080&_p_url=https://it.aliexpress.com/wp.html&cna=<whatever cna is>&category=&aplus=&$${beacon_mini}$$=&yunid=&=&trid=<trid>&asid=<base64 stuff>$${get_sign}$$&p=1&o=linux&b=firefox153&s=1920x1080&w=gecko&ism=other&cache=<7 letters>&lver=8.15.25&jsver=aplus_std&pver=0.7.12&_pw=0&_ph=0&tag=1&stag=-1&lstag=-1&_slog=0
Probably the audio file is coming from one of the unblocked requests but my Debian laptop does not pair with my Bluetooth earpieces so I can't test it.
@FireFoxDudes You need to be addressing fingerprinting
we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored
It can be mitigated, a bit, but I don't see how browsers can win that battle.
Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).
There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc.
I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.
The former is traditional analytics and is not enough to uniquely identify an individual.
Not all analytics are as privacy invasive as fingerprinting.
shockingly little information is required to uniquely identify someone.
"traditional analytics" (lets just say os + browser + some hardware info) is likely to be uniquely identifying when combined with just one other sparse dataset.
>Not all analytics are as privacy invasive as fingerprinting.
fingerprinting isn't a separate category of analytics. every data point can be (and often is) used for fingerprinting.