AliExpress Runs Silent Audio Fingerprinting in the Browser
A developer discovered that opening the AliExpress website triggers silent WebAudio API calls that cause Bluetooth multipoint headphones to switch audio profiles, breaking the connection. The root cause is fingerprinting: AliExpress uses WebAudio to generate a device fingerprint without any visible indication to the user, and the side effect is audible as a Bluetooth glitch.
The HN thread immediately identified the broader implication: audio playback capability in the browser probably should require explicit user permission, the same way camera and microphone do. Right now it doesn't, which means any website can run this kind of silent audio operation. The fingerprinting itself is the surveillance concern, but the Bluetooth disruption is how most users will notice it.
Commenters were skeptical that permission gating would help in practice, noting that users routinely grant permissions without reading them. The real fix is browser vendors treating WebAudio initialization as a permission-requiring action.
So what?
If you're building a web app that uses WebAudio for any legitimate purpose, you're now operating in a space that's going to attract more scrutiny and likely more browser restrictions. Expect WebAudio APIs to get tighter permission requirements in future browser releases. If you're building a product that competes with or integrates AliExpress-style e-commerce, this is also a reminder that the major platforms are tracking far more than cookies.