Android wallpaper images can threaten privacy
fingerprintjs.com
Android wallpaper images can threaten privacy
1–10 of 81 posts
Re: Android wallpaper images can threaten privacy
#2I mean apps already have access to your device ID, no?
Re: Android wallpaper images can threaten privacy
#3I mean apps already have access to your device ID, no?
They don't - without special permissions on newer Android versions (10+). There is an ANDROID_ID but it's scoped to your application on Android 8.0+, reinstalling the same app signed with same key will give you the same key but it returns a different value in other apps. This way you can't use for cross-app tracking.
https://developer.android.com/training/articles/user-data-id...
https://developer.android.com/reference/android/provider/Set...
Re: Android wallpaper images can threaten privacy
#4I mean apps already have access to your device ID, no?
They don't - without special permissions on newer Android versions (10+). There is an ANDROID_ID but it's scoped to your application on Android 8.0+, reinstalling the same app signed with same key will give you the same key but it returns a different value in other apps. This way you can't use for cross-app tracking. https://developer.android.com/training/articles/user-data-id... https://developer.android.com/referen…
How does Google share logins between different apps then? Is there some shared keybag/storage location that only works for the developer's own apps (and is it scoped to the actual developer account, not one that different developers can collude to use together)?
Re: Android wallpaper images can threaten privacy
#5Earlier quoted context omitted.
They don't - without special permissions on newer Android versions (10+). There is an ANDROID_ID but it's scoped to your application on Android 8.0+, reinstalling the same app signed with same key will give you the same key but it returns a different value in other apps. This way you can't use for cross-app tracking. https://developer.android.com/training/articles/user-data-id... https://developer.android.com/referen…
How does Google share logins between different apps then? Is there some shared keybag/storage location that only works for the developer's own apps (and is it scoped to the actual developer account, not one that different developers can collude to use together)?
[deleted]
Re: Android wallpaper images can threaten privacy
#6Earlier quoted context omitted.
They don't - without special permissions on newer Android versions (10+). There is an ANDROID_ID but it's scoped to your application on Android 8.0+, reinstalling the same app signed with same key will give you the same key but it returns a different value in other apps. This way you can't use for cross-app tracking. https://developer.android.com/training/articles/user-data-id... https://developer.android.com/referen…
How does Google share logins between different apps then? Is there some shared keybag/storage location that only works for the developer's own apps (and is it scoped to the actual developer account, not one that different developers can collude to use together)?
I am not sure what mechanism is Google using. But Android apps can talk to each other on the same device and you can restrict this to only applications that are signed with the same certificate (and this is guarded at the OS level).
Re: Android wallpaper images can threaten privacy
#7Although this is an interesting, novel method, there are so many fingerprinting capable APIs in native code that I don't think this matters much.
Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Xiaomi even dumps a world readable unique device ID on the emulated SD card. Not all apps require external storage permissions, but even then there's tons of APIs that can be used to fingerprint the device.
Google is trying their absolute hardest to reduce the fingerprinting surface but as long as system APIs that work with user content like these exist, there will always be something to fingerprint users by. If everything else fails, you could just embed a webview that uses all the javascript stalking we've grown so accustomed to.
It's sad but I don't think you can prevent native code from fingerprinting your device. The sandbox just isn't tight enough and users are too willing to give out permissions.
I can see Google using a predefined set of colours in some update instead of the raw colour values to combat this, but that's only one of many ways apps abuse their users' devices. Unless app stores kick out apps that fingerprint devices, I don't think we'll see any non-fingerprinted devices any time soon.
Re: Android wallpaper images can threaten privacy
#8Earlier quoted context omitted.
They don't - without special permissions on newer Android versions (10+). There is an ANDROID_ID but it's scoped to your application on Android 8.0+, reinstalling the same app signed with same key will give you the same key but it returns a different value in other apps. This way you can't use for cross-app tracking. https://developer.android.com/training/articles/user-data-id... https://developer.android.com/referen…
How does Google share logins between different apps then? Is there some shared keybag/storage location that only works for the developer's own apps (and is it scoped to the actual developer account, not one that different developers can collude to use together)?
>How does Google share logins between different apps then?
google play services
Re: Android wallpaper images can threaten privacy
#9Earlier quoted context omitted.
They don't - without special permissions on newer Android versions (10+). There is an ANDROID_ID but it's scoped to your application on Android 8.0+, reinstalling the same app signed with same key will give you the same key but it returns a different value in other apps. This way you can't use for cross-app tracking. https://developer.android.com/training/articles/user-data-id... https://developer.android.com/referen…
How does Google share logins between different apps then? Is there some shared keybag/storage location that only works for the developer's own apps (and is it scoped to the actual developer account, not one that different developers can collude to use together)?
It seems that you don't use Android. There's an account system apps can use in the os.
Just checked mine, I can see Google, Facebook, Reddit and quite a lot others there
Re: Android wallpaper images can threaten privacy
#10Although this is an interesting, novel method, there are so many fingerprinting capable APIs in native code that I don't think this matters much. Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Xiaomi even dumps a world readable unique device ID on the emulated SD card. Not all apps require external storage permissions, but even then there…
>Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Xiaomi even dumps a world readable unique device ID on the emulated SD card.
They're fixing this with soon with scoped storage api.