The Web Audio API has the ability to extract frequency, waveform, and other data from an audio source, that source is generated at runtime on your device. A firefox developer did a further dive into what the WebAudio based fingerprinting can actually return in firefox. https://developer.mozilla.org/en-US/docs/Web/API/AnalyserNod...

Perhaps accessing the microphone is something else they do, however that is not the issue in my case nor what my article is about.

While it may not be effective at fingerprinting, the side effect of the attempt sure is annoying when it stops my music! Do you know if it would count as a bug if muting the firefox tab or the browser as a whole does not stop the audio stream?

I doubt the FBI will be flying to china to knock down any doors! You aren't wrong though, and countries which enforce GDPR I would expect to make noise if this was happening to their constituents.

Thanks for your input and perspective! Do you think it is a bug that the muting of the firefox tab doesn't stop the audio stream? It is frustrating that companies would use such an annoying tactic to track their users with it also ineffective.

Yes, it is a bug, in fact it's this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1863193#c9 which is of course getting some more attention now =)

Good to know! I have added a note and link to my post.

I touched on this in my article, once the data has been collected and sent to their servers you have no idea what they do with the information. At least with GDPR it is supposed to be regulated but obviously that is not the case everywhere and websites can still lie.

ebay does this i think, someone else linked a post about port scanning

It doesn't actually stream an audio file, the scripts generate audio at runtime using a sawtooth oscillator. It also only happens after several seconds.

Thanks. So one of the downloaded scripts is generating the audio and the browser should detect it.

So what's the current usable fork of uMatrix nowadays?

Switched from NoScript in the days of 'HttpSwitchboard', then over to uMatrix, but using uBo only now.

Still missing some elements of uMatrix, though.

How does it work with uBo now? Where does it interfere? What are the redundancies to check for, and letting only uMatrix(whichever fork) handle it? What to disable in uBo for it to work effectively?

I'm using uMatrix. Works fine for me.

I wonder if it is something firefox and chrome devs need to look at because if it is accessing the audio device surely it should be notified to the user.

As I mentioned, I suspect that this is an active choice, as just displaying the icon whenever a media context exists seems much easier than inspecting the audio stream for non-zero volume media.

I can only assume that there are legitimate reasons for this as well, e.g. websites preparing/maintaining audio context for lower latency when they intermittently play audio etc.

Someone else mentioned that cloudflare uses the webaudio for verification challenge, but only triggers it briefly.

Ugh... Seems like we need an audio API web permission, or maybe do something like browser already do for some of the other APIs and actually require API users to actually play something or display a warning/play an annoying chime otherwise.

Not just notified but blocked by default. We already have similar bocks on autoplaying video (no audio until you interact) and access to microphones and cameras ("allow access.." popups).

Every time an article like this comes out, people wonder about aliexpress instead of why their browser allows this in the first place.

It just annoyed me so much that it was interrupting my music!

Hell hath no fury like an inconvenienced power user.