Are Any Exploitable Identifiers Still Remaining?

edent

What are your "strong suspicions"? Did you just see a related advert - or did you receive a subpoena?

llama420

edent Ha, no subpoena. Not in my range of concerns. Basically, I went to a casino and withdrew some cash to play blackjack. My phone had everything disabled during this time (microphone, camera, network, bluetooth, etc.) and the google user profile was deleted. I didn't do any google browsing on the phone after creating the account. I was using the google account to browse youtube primarily. Upon returning from the trip, I hopped on youtube on Linux only and started seeing casino videos recommended prominently. I never showed any interest in gambling in any of my browsing prior to that point, I'm not really interested in it in general. The account was only a day or two old and I only watched gaming or privacy videos (ironic for youtube, but there's a market for it). I clicked through a few unrelated videos to test if it was a fluke, but the casino videos kept getting recommended. Google made some deals with credit card companies a while ago, and have access to ₇₀% of of all retail transaction data to prove ad effectiveness offline, so the suspicion is warranted.

dawt

llama420 I have a strong suspicion that google was able to tie a bank purchase to a burner google account I made in its own profile on the sandboxed play store with a VPN (Mullvad), and no SIM in the phone at the time.

You're going to have to provide more details than this. If it's something like "I bought cat food using my bank card and now google is showing me ads for cat food", that could easily be explained by "it's a coincidence" and/or user profiling, ie. people using grapheneos profiles and VPNs (both of which are easily detectable) tend to have cats.

llama420

dawt Please see my response to edent, explained more about it there.

Chipper

Chipper oh i missed, the (mullvad) part, i dont know how they manage local traffic.

basedFOSS

llama420 Withdrawing a larger amount of cash in or nearby a casino could have also led to your financial institution to have shared data with 3rd parties.

Maybe you can think of more reasons that have nothing to do with your devices

llama420

Chipper That's creepy as fuck. These companies are gross. Do you know if they would be able to communicate even if background is disabled for both the banking profile and google profile?

Chipper

llama420 Yeah, definitely a very underhanded way to do business.
In the same thread i referenced earlier a user dawt mentions that the loopback method of inter profile communication, is utilized by an app called " Inter profile sharing" this is available from the Accrescent store, if you wanted to test it you could do so with that.
Personally i think it would have zero impact, as once its broadcast the message whether or not it remains active is irrelevant to that message being picked up.

llama420

Chipper Alright, thank you.

Meatheadmarty

My understanding is many Apps use webview to display parts of Apps, and the default Webview on Graphene OS is Vandium.

I am not an expert. This could all be wrong.

Vandium does not protect against Canvas Fingerprinting. So if the Banking App used Canvas Fingerprinting and got a specific unique value, and then Google Play got a unique specific value, and if those same values were sold to a data broker and matched, they woukd know you are the same person.

Graphene is a secure operating system but it is not inherently anonymous for Apps that use any KYC identity. So if you were to try to do something illegal in one Profile and something legal with KYC in another, they can probably figure out it's you.

Again this conception may be completely false. It would be interesting to know what Daniel or MatchBoxEnergy thinks about this.

A lot of times GOS developers have suggested that mitigating device fingerpritning is so impossible that it's almost pointless. I am also not sure if Vandium has implemented any blocking of Canvas fingerprinting. A problem with doing that it is could make other Apps not work as well since Canvas randomization is detectable.

llama420

Meatheadmarty Interesting, thank you. I assumed a general fingerprint (device model, OS version, etc.) would be available, just hoped it wouldn't have been identifiable.

Carlos-Anso

I wrote about this here -
https://discuss.grapheneos.org/d/17118-identifiers-across-private-space-and-profiles/4

Also some details of planned work in this area
https://grapheneos.social/@GrapheneOS/114275044547911381

llama420

Carlos-Anso Damn, that just about explains it. Thank you. Hopefully you guys can chip away at these over time, though I imagine it's hard to do. I've since deleted the banking app and the google account. I'll just be sticking with privacy respecting apps, using websites for the rest, depositing checks in person, paying with cash in stores, etc. for the foreseeable future.

llama420

basedFOSS It would have to be linked to a device because there was no financial or identifiable information provided to the google account aside from the identifiers of the phone and Linux browser, and I held no other google accounts.

Meatheadmarty

Graphene developers have said before that virtualization would be the only way to change the identifier problem substantially, and that this would require ram and processing and development time that would be many years away, but I wish Vandium which is used for webview prorected against tracking better. So don't expect any changes.