Unique DRM ID

kirillan10

Hello!
I have used fingerprint check apps on different phone profiles. In all cases, the Media DRM ID was identical, which allows app to match the profiles and see that they belong to the same person. How can I avoid this?
Thank you!

kirillan10

For example, Fingerprint OSS demo app. It shows unique DRM ID which allows app to identify me between profiles...

de0u

kirillan10 https://github.com/GrapheneOS/os-issue-tracker/issues/2314

GrapheneOS

kirillan10 Android has a flaw where it's the same in the same app across profiles but it should be different between different apps already. Need to test with 2 different apps or a build of the same app with a different app id and signing key.

Carlos-Anso

Can demonstrate with these two apps which each show a different DRM ID. The same app in different profiles shows same DRM ID

https://github.com/fingerprintjs/fingerprintjs-android

https://github.com/trustdecision/trustdevice-android

Trouble is that there are other techniques apps can use to identify that they are running on the same device. See my post here
https://discuss.grapheneos.org/d/17118-identifiers-across-private-space-and-profiles/4

amusement_grievous292

Carlos-Anso
It sounds like the other techniques are correlation attacks, while this one is a unique identifier. If anything, it should have a higher priority for fixing than the rest.

This also especially impacts using sandboxed Google services in multiple profiles for identity isolation. I imagine getting the DRM ID can be considered legitimate, routine usage for Google services. All of them will recognize they are the same device immediately, even if you create a temporary profile for a short time.

thmf

amusement_grievous292 I imagine getting the DRM ID can be considered legitimate, routine usage

It is, see here.

Carlos-Anso

amusement_grievous292 All of them will recognize they are the same device immediately, even if you create a temporary profile for a short time.

Same for install time, which is recorded to the millisecond, of any apps that are in more than one profile, Also a commonly used identifier, can see it mentioned in the Android developer docs thmf links.

Apps have can get information about the device in various ways. It really needs thorough research to work out all the possible ways apps could attain high confidence for a given scenario. For example 'apps in profiles that never run at the same time' to make a useful implementation of 'non linkable profiles'

As mentioned in one of my later post in this prior discussion If you are looking to be able to run the same apps in different profiles on the same device without them being able to work out they are running on the same device achieving that goal is much more realizable by running another OS in a vm or a emulator. Like I said there's currently no great solution. With Googles work on Android Virtualization Framework hopefully GrapheneOS can make it possible for users to run virtual machines before too long.

In the past I have known developers who worked building tracking tech for Android and iOS apps use Limbo on their personal Android devices so they could run apps they really didnt want somehow tied to their real ID. Limbo has been abandoned for some time now. Was no great choice of operating systems to run and performance wasn't great.

amusement_grievous292

Carlos-Anso
Thank you for the explanation. That sounds bleak. One more thing to look forward to with improved VM support in Android, then. Qemu on Termux is such a terrible experience.

Graph83

Hello everyone,

I’m bumping this thread—rather than starting a new one—to provide an update on the infamous Media DRM ID issue.

I recently bought a used Pixel 9 Pro and immediately installed GOS on it. Naturally, the phone had already been used by at least one person before me—likely with Google Play Services and various apps from the Play Store installed.

Since the Media DRM ID apparently persists even after a factory reset, does this mean that the moment I install Google Play Services and apps via the Play Store (as recommended by the GOS developers), my digital identity could be linked to that of the phone's previous owner(s)?

It’s a shame GOS hasn't resolved this issue yet.

My research led me to a recent post (from two months ago). Is the option to toggle access to the DRM ID actually going to be added to GOS soon?

I also came across a post stating that the DRM ID can be spoofed using a developer mode setting. I tested this using this Fingerprint app, and the Media DRM ID did indeed change once the option was enabled.

Would this be a satisfactory workaround until GOS implements its own long-awaited solution for this?

Thanks in advance for your feedback.

de0u

Graph83 Something to keep in mind is that the Media DRM i.d. was not designed as a tracking feature; it is part of the content-protection system for, e.g., subscription-based streaming services. So it may well be the case that the developer option will change the i.d. number but cause Netflix (etc.) to severely downgrade video quality. Some time back there was a temporary glitch in the DRM system, and there was a huge volume of forum posts, so it seems plausible that some GrapheneOS users rely on subscription-based streaming services.

Graph83

de0u

Yes, I know, but personally, I don't use streaming services on my smartphone.

As for the rest, it's rather mysterious, but there's nothing to say that Google and certain apps don't use this DRM ID to "track" us and replace the IMEI, which they can't access on GOS.

Here is an interesting publication on the subject.

de0u

Graph83 Here is an interesting publication on the subject.

It's thin to the point of being non-evidentiary. There is an unsupported claim about SnapChat and that's it. There isn't even a claim that analyzing the SnapChat APK or runtime behavior shows relevant API calls. Did I overlook something there beyond rumor recycling?

FunkTastic

Where is that DRM ID actually located?

Byku

Graph83 I also came across a post stating that the DRM ID can be spoofed using a developer mode setting. I tested this using this Fingerprint app, and the Media DRM ID did indeed change once the option was enabled.

According to the same post mediaDRM still remains consistent for the same app across profiles with this option on. Did you check it?

Graph83

Byku

Yes, the Android ID changes, but the DRM ID does not change from one profile to another (it is simply different from the original once the specified option is enabled).