Questions about ANDROID_ID

User2288

A few questions about ANDROID_ID.

The website says:

The ANDROID_ID string is a 64-bit random number, unique to each combination of profile and app signing key.

It's tied to the lifetime of profiles...

In the future, GrapheneOS will likely change this to be tied to the lifetime of app installations rather than profiles.

So when you reinstall an app on a profile, does it get the same ANDROID_ID?
Is this Id saved somewhere in user accessible space and can be deleted? Or is it protected?
Can other apps see the ANDROID_ID of an app?
Can other apps see the ANDROID_ID of an uninstalled app after it was uninstalled to know "what was installed on this profile before"?
Is this ANDROID_ID a random number derived from the app signing key alone, or is it also derived from some unique "aspect" about the profile?
Are there ANY profile identifiers (aspects) of any sort?
If not already answered, how is the ANDROID_ID persisting?

Thank you.

UpStream

User2288 Some questions can be answered by reading what you've linked.

I just read it and I'll answer your questions according to what I've understood while reading the GrapheneOS resource you've provided (Not sure if I've understood it correctly tho):

1: Yes
2: It can be deleted by deleting the profile. If you want to delete your owner profiles ANDROID_ID you'd have to do a factory reset I guess otherwise if it's a guest profile just delete it and create a new one.
5:

The ANDROID_ID string is a 64-bit random number, unique to each combination of profile and app signing key.

6:
https://grapheneos.org/faq#hardware-identifiers
https://grapheneos.org/faq#non-hardware-identifiers

UpStream

User2288 Also note that there's another ID called MediaDrm ID.
This can be used to track you and it doesn't change even after factory resetting your device.

other8026

User2288 I tried looking into this and I think I found some helpful info.

Basically, ANDROID_ID seems to be generated once, then it's stored in a database. I was unable to interact with the database when I tried quickly. I doubt it's possible.

As far as I can tell from reading the website and elsewhere, ANDROID_ID will be the same after reinstalling the same app. One source says the signatures need to be the same for an ANDROID_ID to be the same after reinstalling. It appears there's a function that removes ANDROID_IDs for apps that have been uninstalled, though I'm not sure exactly when it's run or how often. Based on the name, I think it's run on startup / when unlocking a profile and a new session starts, but I don't know for sure.

When looking through the code, I didn't see anything that allows an app to get another app's ANDROID_ID, but even if it were or is possible, I don't see how that would matter. It's only part of the original hash. Not very useful. Apps can just list other installed apps in the same profile anyway. Getting an ID isn't going to reveal any other info that isn't already available.

I don't want to attempt to say exactly how ANDROID_IDs are generated. I'm worried I'll use the wrong words. But, basically, there are two inputs that I could find: a completely randomly generated user ID (which is only used for this purpose as far as I can tell) and an app's signatures.

Here's the code for generating new ANDROID_IDs if anyone is curious.

User2288

UpStream
Yes but see, i have already read that multiple times over and after thinking about it thoroughly I still felt like I needed to ask these explicit questions.

So referring me to the same source doesn't really help. I understand what those words "imply", but my "interpretation" of the the "implications" of those sentences wasn't good enough for me, hence my asking of these explicit questions.

I'm hoping someone with a deeper understanding can see the merit of my "apparently redundant" (but not actually) questions and clarifies. 😌

User2288

other8026
Perfect. Thanks for the detailed answer.

One more question, which i think you will know.

When apps see the name of other apps, do they see a generic package name? Or does the name have any uniqueness that allows apps to distinguish the "package name" in this profile from another profile or phone from phone, for the same app version?

Ultimately I'm asking all these questions because I'm trying to determine whether an ANDROID_ID or package name could be used to "mark" a profile by other apps.

[deleted]

User2288 They see the generic com.something.something, the app name and other metadata, nothing will change if you install the same apk to any other device or profile, they see the same thing. But apps that can read your app list with the permission QUERY_ALL_PACKAGES. While a single package name is not helpful for tracking, your app list is unique and apps with this perm can precisely fingerprint you.

GrapheneOS

@[deleted] That's not correct, Apps can query information about all the user installed apps in the same profile without QUERY_ALL_PACKAGES. It only avoids them having to list a query matching all the user installed apps. Apps can detect all apps in the same user profile without either explicit queries or QUERY_ALL_PACKAGES. This is the issue with trying to interpret low-level information from the manifest or relying on inaccurate permission information from Exodus Privacy or Aurora Store.

[deleted]

GrapheneOS Thank you for the correction.