I wish such shenanigans would simply trigger the little speaker icon most browser display on tabs these days.
Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content...
Now I wonder, does this also allow websites to continue running in the background on mobile browsers? Playing media is one of the very few things that can convince iOS Safari to keep a tab running indefinitely, in my experience.
Recently I have been getting a request from chrome for access to local network devices. I can’t figure out which site I’m visiting is doing this, because the request doesn’t specify which tab. I would LOVE a little icon for something like that.
Are you running PiHole, Adguard or similar and using macOS? On macOS, Chrome treats 0.0.0.0 as a local address which results in these prompts. Switching to having blocked domains return NXDOMAIN can work around the issue.
I would note that if you say no to this, not only automatic but also explicit top-level navigation to “local network” locations (e.g. localhost, 192.168.1.x, etc) will be denied. Kind of annoying when you don’t want Chrome exploring your network, yet still need to regularly e.g. access your NAS web dashboard.
For a while there's been an anti-pattern where a piece of software leaves a localhost daemon running (often without proper security) for web integration.
XSRF vulns also have existed where e.g. a web page can blinding attempt to hit your router's page to change your DNS servers by knowing common router admin sites and default home network topologies. This isn't as useful in today's HTTPS world.
Browsers have been adding more partitioning between local and internet resources to prevent this sort of thing. But that does mean simply putting localhost entries in a hosts file to blackhole a site can now cause an issue.
3D mice and other hardware may run a local server for web applications to use them as input methods. The dialog can also show up if you are using network security software which proxies requests via private IP address range. Plenty of other non-nefarious reasons too...
Safari and Firefox allow this by default without a prompt or visible indicator (but maybe that has changed now that Chrome added its dialog).
Then it’s most likely Chrome using local network access for WebRTC or Chrome without granting that access to websites without any explicit interaction with camera permissions or cast features.
Yeah, that’s always an automatic nope. No explanation of who/what is really asking or why so, no: your shit software or website can’t go snooping around on whatever network I happen to be on, whether that’s at home or at work.
Something in my work's SSO / auth mechanism does this and if you click No it silently screws up the internal website you're visiting. It doesn't block you from logging in, just parts of the site don't load/work. I haven't been able to get a good answer on what the heck is going on but it's extremely annoying.
I wonder if it is something firefox and chrome devs need to look at because if it is accessing the audio device surely it should be notified to the user.
As I mentioned, I suspect that this is an active choice, as just displaying the icon whenever a media context exists seems much easier than inspecting the audio stream for non-zero volume media.
I can only assume that there are legitimate reasons for this as well, e.g. websites preparing/maintaining audio context for lower latency when they intermittently play audio etc.
Ugh... Seems like we need an audio API web permission, or maybe do something like browser already do for some of the other APIs and actually require API users to actually play something or display a warning/play an annoying chime otherwise.
Not just notified but blocked by default. We already have similar bocks on autoplaying video (no audio until you interact) and access to microphones and cameras ("allow access.." popups).
Every time an article like this comes out, people wonder about aliexpress instead of why their browser allows this in the first place.
> I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content
When most sites do browser fingerprinting using audio, they use an 'OfflineAudioContext' - which unlike a normal AudioContext, doesn't run in real time and send its output to system's loudspeakers; instead, it runs faster-than-real-time and outputs to an AudioBuffer. So the browser can easily tell no sound is being played.
For example - you can tell the browser to create a 10kHz square wave, feed it to a GainNode then a DynamicsCompressorNode, output to a buffer, then hash the contents of that buffer - which gives you a browser fingerprint, because of subtle differences between browsers.
While it may not be effective at fingerprinting, the side effect of the attempt sure is annoying when it stops my music! Do you know if it would count as a bug if muting the firefox tab or the browser as a whole does not stop the audio stream?
It's insane that browsers just hand over API access to my microphone and/or camera to rando web developers. Yes, I know things like Zoom exist. IMO software like that simply shouldn't be possible on browsers, period.
Making the browser into a general purpose system SDK was a mistake--maybe the biggest mistake in personal computing's history.
I do not have the Zoom app in any form installed. I'd much rather use it in the browser. When I close the tab, Zoom is gone. After the COVID era bullshit of Zoom installing a utility that gives root access to anything, I've never installed it. Luckily, all of that came out before I started using Zoom.
1. Not make web browser general-purpose runtimes for arbitrary software.
2. OS builds a general-purposes runtime that's completely sandboxed. So users can run more complex software without needing to worry about cruft being installed on their system.
Unfortunately, browser builders have decided that web browsers are #2.
What is the practical difference if the OS provides your general-purpose sandboxed runtime instead of the browser? The browser is already a product being developed by the same organization as the OS for a significant chunk of people.
iOS -> Safari
Android -> Chrome
Windows -> Edge (based on Chromium, so fixes in Edge make their way into Chrome too)
The sandboxed application would be something you explicitly chose to run. When the browser is the platform, every web page you visit has access to the general-purpose runtime. (Of course permission checks e.g. for microphones exist.)
Why do you still need an explicit install step if everything is correctly sandboxed? If your only answer is you don't trust the sandbox then you shouldn't trust the one provided by the OS, either. Your browser's sandbox is tested way more than anything else.
They don't "just hand over access". If anything, browsers pioneered permissions for mic and camera on desktops, having them several years earlier before windows even got around to having these things restricted under permissions.
Also, people can and should go to the firefox settings > Permissions and data > Autoplay and change the Default for all websites to "Block Audio" (at least).
You can set per-hostname exceptions if you like! CTRL + I > Permissions
> You can set per-hostname exceptions if you like! CTRL + I > Permissions
1. Thank you, that's very nice to know about.
2. I really wish this was exposed more directly, probably from the permissions button that is already in the address bar. I can't believe Chrome does this better.
You can access page info through address bar shield > connection secure > more site information too. It used to be easier to access from there, but they redesigned that at some point I think.
I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue.
@FireFoxDudes You need to be addressing fingerprinting
Fingerprinting cannot be resisted. There are a zillion techniques to get bits of information which can provide a unique-ish identifier when combined. The only protection is to mix in some random data in all these bits to get a very unique combination that changes on each request. But this only works if at the same time cookie and local storage access is disabled for all sites and whitelisted per site:target combination.
I feel like there are two levels of fingerprinting here, and a lot of the confusion is downstream of not properly distinguishing them:
There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc.
I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.
I've only encountered the latter described as fingerprinting. Which makes sense side, like fingerprints, the information is being used to uniquely identify an individual.
The former is traditional analytics and is not enough to uniquely identify an individual.
Not all analytics are as privacy invasive as fingerprinting.
>The former is traditional analytics and is not enough to uniquely identify an individual
shockingly little information is required to uniquely identify someone.
"traditional analytics" (lets just say os + browser + some hardware info) is likely to be uniquely identifying when combined with just one other sparse dataset.
>Not all analytics are as privacy invasive as fingerprinting.
fingerprinting isn't a separate category of analytics. every data point can be (and often is) used for fingerprinting.
a lot of what is used for fingerprinting is also used legitimately, and a lot of sites fingerprint. so ~every site would be behind a security risk warning.
we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored
Presumably the intended outcome would be that sites would be pressured into not being malignant actors with regards to user privacy, rather than everyone just ignoring the security notice.
i understand the intention, and i offered my opinion on what the actual outcome would be.
~every piece of data can be used for fingerprinting. settings and preferences, browser, os, etc. fingerprinting is not its own category of data, it's the correlation of regular data.
the "pressure" ends up being: stop receiving any data at all (which would obviously break ~everything), or put up a warning (leading to fatigue).
consider accessibility settings: absolutely required for some people to browse the internet, but also extremely high-value data for fingerprinting a user.
there is no technical method to know whether a site asking about a visitor's accessibility settings is doing it so that they can properly display content or so that they can fingerprint the visitor. (i.e. there is no "evil bit")
I touched on this in my article, once the data has been collected and sent to their servers you have no idea what they do with the information. At least with GDPR it is supposed to be regulated but obviously that is not the case everywhere and websites can still lie.
Or just started removing features and debloating the Web standards. We don't need WebCoffeeBeansRoasterGrinder or WebElectricVehicleEmergencyBraking. We should be able to live with a LOT less without graphics, performance, or addictiveness degradation.
The speaker icon would be handy but I think that it depends from both the good will of Firefox and the installed add ons. Of course if an add on blocks the audio file there is no need to display the speaker icon for that file.
To give you the idea of what is going on, this is what uMatrix shows about www.aliexpress.com in my Firefox browser on my laptop. It would be more difficult to copy and paste from uMatrix on my Android phone. It shows a number of sites. Nothing in first party and these that I must fully enable to make the site work (css, image, script, xhr)
* aliexpress.com
* ase.aliexpress.com
* it.aliexpress.com (my country two letters domain)
* umdc-global.aliexpress.com
* aidcgroup.net
* ase.aidcgroup.net
* 67372.ase.aidcgroup.net
* alibaba-inc.com
* epss.alibaba-inc.com
* alicdn.com
* ae01.alicdn.com
* assets.alicdn.com
* aliexpress-media.com
* ae-pic-a1.aliexpress-media.com
* assets.aliexpress-media.com
* aliyun.com
* acjs.aliyun.com
Scary list, right? According to google aidcroup is
> Alibaba International is committed to the protection of intellectual property rights. Right holders and their agents can enforce intellectual property ...
Let me add a /s to the last line
There are two more sites that I can completely block
* googlesyndication.com
* pagead2.googlesyndication.com
so even Alibaba runs ads on Google.
I did not instrument the browser like the author of the post did, so I don't know where the audio comes from. There is nothing listed in the media column of uMatrix. This does not mean that the post is inaccurate. It could be that the browser gets the audio stream from a request in one of the other categories.
Probably the audio file is coming from one of the unblocked requests but my Debian laptop does not pair with my Bluetooth earpieces so I can't test it.
It doesn't actually stream an audio file, the scripts generate audio at runtime using a sawtooth oscillator. It also only happens after several seconds.
So what's the current usable fork of uMatrix nowadays?
Switched from NoScript in the days of 'HttpSwitchboard', then over to uMatrix, but using uBo only now.
Still missing some elements of uMatrix, though.
How does it work with uBo now? Where does it interfere? What are the redundancies to check for, and letting only uMatrix(whichever fork) handle it? What to disable in uBo for it to work effectively?
Given that they don't (at least in my experience), I'm assuming "playing silent audio" is a sufficiently common thing for websites to do to have motivated browsers into doing the slightly more complicated thing of actually analyzing audio streams for content...
Now I wonder, does this also allow websites to continue running in the background on mobile browsers? Playing media is one of the very few things that can convince iOS Safari to keep a tab running indefinitely, in my experience.