Are Any Exploitable Identifiers Still Remaining?

llama420

I want to preface this with a clear statement that this is in no way an accusation or critique of Graphene devs. You guys are awesome. I love your OS and the support you've kindly provided me in the past.

Can somebody please explain the current status of identifiers and how they can or cannot persist across different user profiles?

I have a strong suspicion that google was able to tie a bank purchase to a burner google account I made in its own profile on the sandboxed play store with a VPN (Mullvad), and no SIM in the phone at the time. The profile was deleted prior to the purchase, the SIM was only reinserted after its deletion, and the google account was only ever accessed through a VPN in Mullvad browser on Linux after its creation. The account had no identifiable characteristics, phone number, or payment information given to it, and it was only ever accessed from a clean session (no CSS or cookies) with no other accounts logged in. Nothing related to the purchase was ever looked up or related to anything I browsed on google services.

I had my banking app in its own profile as well, also with a VPN. This banking profile was not accessed until after the google profile was deleted. There could be a handful of scenarios that led to this. The only ones I can imagine are exploits of my Proton Pass extension from google's sites to acquire my banking info, an exploit of Graphene OS by google while play store was installed and logged in, or possibly (but less likely) an exploit of my Linux OS from google's sites on the browser.

I've been poking around a while and found some stuff from years ago saying the DRM ID persists across different installs/user profiles. More recent posts suggest they vary for each app, but the same app will have the same DRM ID across different profiles. They've been talking about a toggle for it for years, but it's been non-priority since it didn't pose a big risk to profiling/fingerprinting.

Any ideas? I'm just trying to figure out how this was possible.

dawt

llama420 I have a strong suspicion that google was able to tie a bank purchase to a burner google account I made in its own profile on the sandboxed play store with a VPN (Mullvad), and no SIM in the phone at the time.

You're going to have to provide more details than this. If it's something like "I bought cat food using my bank card and now google is showing me ads for cat food", that could easily be explained by "it's a coincidence" and/or user profiling, ie. people using grapheneos profiles and VPNs (both of which are easily detectable) tend to have cats.

llama420

Also, none of the profiles had background services enabled, if relevant.

Chipper

Theres a post by ryona in this thread which may cover this, the guts being the same app may if designed to do so, listen on localhost and use this to communicate across profiles. You said you use proton pass, which suggests you may also use proton vpn, which has a toggle allowing non vpn routing of local traffic (for printers etc) i havent played around with whether disabling this toggle would prevent the localhost sharing but if you do have it enabled i suspect there is a strong chance this is what has occurred.

Chipper

Chipper oh i missed, the (mullvad) part, i dont know how they manage local traffic.

llama420

Chipper That's creepy as fuck. These companies are gross. Do you know if they would be able to communicate even if background is disabled for both the banking profile and google profile?

edent

What are your "strong suspicions"? Did you just see a related advert - or did you receive a subpoena?

llama420

edent Ha, no subpoena. Not in my range of concerns. Basically, I went to a casino and withdrew some cash to play blackjack. My phone had everything disabled during this time (microphone, camera, network, bluetooth, etc.) and the google user profile was deleted. I didn't do any google browsing on the phone after creating the account. I was using the google account to browse youtube primarily. Upon returning from the trip, I hopped on youtube on Linux only and started seeing casino videos recommended prominently. I never showed any interest in gambling in any of my browsing prior to that point, I'm not really interested in it in general. The account was only a day or two old and I only watched gaming or privacy videos (ironic for youtube, but there's a market for it). I clicked through a few unrelated videos to test if it was a fluke, but the casino videos kept getting recommended. Google made some deals with credit card companies a while ago, and have access to ₇₀% of of all retail transaction data to prove ad effectiveness offline, so the suspicion is warranted.

llama420

dawt Please see my response to edent, explained more about it there.

basedFOSS

llama420 Withdrawing a larger amount of cash in or nearby a casino could have also led to your financial institution to have shared data with 3rd parties.

Maybe you can think of more reasons that have nothing to do with your devices

Chipper

llama420 Yeah, definitely a very underhanded way to do business.
In the same thread i referenced earlier a user dawt mentions that the loopback method of inter profile communication, is utilized by an app called " Inter profile sharing" this is available from the Accrescent store, if you wanted to test it you could do so with that.
Personally i think it would have zero impact, as once its broadcast the message whether or not it remains active is irrelevant to that message being picked up.

llama420

Chipper Alright, thank you.

Meatheadmarty

My understanding is many Apps use webview to display parts of Apps, and the default Webview on Graphene OS is Vandium.

I am not an expert. This could all be wrong.

Vandium does not protect against Canvas Fingerprinting. So if the Banking App used Canvas Fingerprinting and got a specific unique value, and then Google Play got a unique specific value, and if those same values were sold to a data broker and matched, they woukd know you are the same person.

Graphene is a secure operating system but it is not inherently anonymous for Apps that use any KYC identity. So if you were to try to do something illegal in one Profile and something legal with KYC in another, they can probably figure out it's you.

Again this conception may be completely false. It would be interesting to know what Daniel or MatchBoxEnergy thinks about this.

A lot of times GOS developers have suggested that mitigating device fingerpritning is so impossible that it's almost pointless. I am also not sure if Vandium has implemented any blocking of Canvas fingerprinting. A problem with doing that it is could make other Apps not work as well since Canvas randomization is detectable.

llama420

Meatheadmarty Interesting, thank you. I assumed a general fingerprint (device model, OS version, etc.) would be available, just hoped it wouldn't have been identifiable.

Carlos-Anso

I wrote about this here -
https://discuss.grapheneos.org/d/17118-identifiers-across-private-space-and-profiles/4

Also some details of planned work in this area
https://grapheneos.social/@GrapheneOS/114275044547911381

llama420

Carlos-Anso Damn, that just about explains it. Thank you. Hopefully you guys can chip away at these over time, though I imagine it's hard to do. I've since deleted the banking app and the google account. I'll just be sticking with privacy respecting apps, using websites for the rest, depositing checks in person, paying with cash in stores, etc. for the foreseeable future.

llama420

basedFOSS It would have to be linked to a device because there was no financial or identifiable information provided to the google account aside from the identifiers of the phone and Linux browser, and I held no other google accounts.

Meatheadmarty

Graphene developers have said before that virtualization would be the only way to change the identifier problem substantially, and that this would require ram and processing and development time that would be many years away, but I wish Vandium which is used for webview prorected against tracking better. So don't expect any changes.