Live data from Hacker News

Android wallpaper images can threaten privacy

fingerprintjs.com

41–50 of 81 posts

Re: Android wallpaper images can threaten privacy

#41

It's not constant. I expect that people change wallpaper frequently.

Android dev here. Still have the same default wallpaper as my Pixel 3 came with 3 years ago.

That wallpaper would have the same 3 colors as many, many, other people. The problem here arises when your wallpaper is unique, no?

Re: Android wallpaper images can threaten privacy

#42
post #39

Would the way to counter this be using a default / well-known wallpaper? You'd have the same the wallpaper "ID" as several others who stick to the default wallpaper.

That, and/or change your wallpaper relatively frequently.

There seem to be apps that can automate changing your wallpaper, including an official Google one.

Re: Android wallpaper images can threaten privacy

#43
post #10
post #7

Although this is an interesting, novel method, there are so many fingerprinting capable APIs in native code that I don't think this matters much. Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Xiaomi even dumps a world readable unique device ID on the emulated SD card. Not all apps require external storage permissions, but even then there…

>Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Xiaomi even dumps a world readable unique device ID on the emulated SD card. They're fixing this with soon with scoped storage api.

A decade later and they're implementing folder permissions...?

Re: Android wallpaper images can threaten privacy

#44
post #7

Although this is an interesting, novel method, there are so many fingerprinting capable APIs in native code that I don't think this matters much. Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Xiaomi even dumps a world readable unique device ID on the emulated SD card. Not all apps require external storage permissions, but even then there…

Not saying this would be easy but another approach would be to use references to the colors instead of the actual colors. Other color related APIs would have to be updated to accept the references or, if you wanted to add more flexibility, compound color manipulation operations. It would be the responsibility of the renderer, which I am assuming is protected as I am not familiar at all with android, to compute the final color and not reveal it to the app.

It wouldn’t be a perfect replacement for actual color values but it would give more flexibility while not revealing the value.

Re: Android wallpaper images can threaten privacy

#45

Earlier quoted context omitted.

Could fuchsia be the solution to this? It's a fresh start and no company is depending on any of its api. But I guess fuchsia is a flaw for its own because of google...

I would assume the opposite. Why a company which makes money from tracking users for many reasons develops an OS which prevents tracking? My guess is that it'd be an OS which would perform tasks Google needs to stay as Google better than Android, and Google may sell these capabilities to devs to further enhance their bottom line.

Google cannot change the Linux kernel like they control Chromium or the most of the Android, so with Fuchia (or its kernel) they are more in control once again.

Re: Android wallpaper images can threaten privacy

#46
post #7

Although this is an interesting, novel method, there are so many fingerprinting capable APIs in native code that I don't think this matters much. Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Xiaomi even dumps a world readable unique device ID on the emulated SD card. Not all apps require external storage permissions, but even then there…

Not saying this would be easy but another approach would be to use references to the colors instead of the actual colors. Other color related APIs would have to be updated to accept the references or, if you wanted to add more flexibility, compound color manipulation operations. It would be the responsibility of the renderer, which I am assuming is protected as I am not familiar at all with android, to compute the fi…

Reason #481 virtualization-capable phones would be a huge privacy win.

Re: Android wallpaper images can threaten privacy

#47

I mean apps already have access to your device ID, no?

They don't - without special permissions on newer Android versions (10+). There is an ANDROID_ID but it's scoped to your application on Android 8.0+, reinstalling the same app signed with same key will give you the same key but it returns a different value in other apps. This way you can't use for cross-app tracking. https://developer.android.com/training/articles/user-data-id... https://developer.android.com/referen…

However, the restriction only apply to asop/pixel devices. For other devices, often there is a way to extract unique id/ imei with hidden api without any premissions.

Re: Android wallpaper images can threaten privacy

#48
post #10
post #7

Although this is an interesting, novel method, there are so many fingerprinting capable APIs in native code that I don't think this matters much. Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Xiaomi even dumps a world readable unique device ID on the emulated SD card. Not all apps require external storage permissions, but even then there…

>Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Xiaomi even dumps a world readable unique device ID on the emulated SD card. They're fixing this with soon with scoped storage api.

At this point, I am starting to feel permission fatigue.

Re: Android wallpaper images can threaten privacy

#49
post #7

Although this is an interesting, novel method, there are so many fingerprinting capable APIs in native code that I don't think this matters much. Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Xiaomi even dumps a world readable unique device ID on the emulated SD card. Not all apps require external storage permissions, but even then there…

Chasing this dragon is exhausting, and seems to be requiring more user-hostile measures that prevent end users from using their device fully.

Can there be a legal frame work where Google and Apple just take your source code and builds it on their farm, and app review is a source-code level review? And Developers that refuse to do these things are just blocked from developing on these platforms?

Re: Android wallpaper images can threaten privacy

#50
post #7

Although this is an interesting, novel method, there are so many fingerprinting capable APIs in native code that I don't think this matters much. Many apps I use daily require internal storage permissions and a bunch of them drop random dotfiles with magical IDs in there. Xiaomi even dumps a world readable unique device ID on the emulated SD card. Not all apps require external storage permissions, but even then there…

Not saying this would be easy but another approach would be to use references to the colors instead of the actual colors. Other color related APIs would have to be updated to accept the references or, if you wanted to add more flexibility, compound color manipulation operations. It would be the responsibility of the renderer, which I am assuming is protected as I am not familiar at all with android, to compute the fi…

Or just use much lower precision for the color
Post reply on HN