Device fingerprinting via an application

865be553dc4f5b2b

Suppose I want to create an application whose sole purpose is to fingerprint a device and share it with me via some kind of a server request. Meaning, it gets me a fingerprint the first time a user opens said app, and even after a user completely uninstalls the app and re-installs it back some time later, it would still give me exactly the same fingerprint. The application itself is supposed to be generic, i.e. not containing any specific unique code for every user.

Is it possible and what are my options? One possible approach that I see is using the web view to fingerprint the browser, are there any other options and is it possible for a user to defeat them all in Graphene OS?

Just wanted to note here that I'm not talking about human hand fingerprints, but about device fingerprints.

other8026

865be553dc4f5b2b can I ask why? This community is very knowledgeable, but if you are trying to track others I don't think the community would want to help you since we value privacy.

I'm going to assume the reason is you want to learn more. It's been a while since I used it, but this app does have some of what you're asking: https://github.com/fingerprintjs/fingerprintjs-android?tab=readme-ov-file#fingerprint-android-demo-app

865be553dc4f5b2b

The real reason is to understand how to avoid fingerprinting and to do that a list of fingerprintable values provided by Graphene OS is necessary.

I don't have GrapheneOS installed yet, so I can't test that application yet, but if it does work then it's necessary to understand if things like that can be avoided.

de0u

865be553dc4f5b2b Issue 2314 may be of interest.

bookreader

https://developer.android.com/training/articles/user-data-ids

Also https://developer.android.com/reference/android/provider/Settings.Secure.html#ANDROID_ID

Android ID used to be a unique random number generated on first boot, but now its got a few more elements added into it. If an application is uninstalled and reinstalled, it will be the same, but if factory reset, it will be new. Its unique for each application signing key so that you can't cross reference with other application developers to track users.

865be553dc4f5b2b

de0u Yes, that's interesting. If anything, I think it's a big privacy issue, the ability for various IDs to persist among the app reinstalls. Google's documentation only implores the developer to use those IDs "correctly", yeah right... Strange this issue hadn't been more widely discussed.

de0u

865be553dc4f5b2b If you can confirm Media DRM i.d. persists from an app standpoint across factory reset on a modern device please add a comment to the issue.