What do apps know about their environment on GOS?

Eumenia

If an android app only has basic permissions, what can the app know about the device its installed on?
If I clear the storage and change the IP (through Orbot/VPN) can the app still knows that it's on the same device?

I am talking about an open source app and under the assumption that no trackers are included, but please also note if an app can use special trackers do gain additional information.

Probably9857

Eumenia If I clear the storage and change the IP (through Orbot/VPN) can the app still knows that it's on the same device?

Potentially.

https://grapheneos.org/faq#hardware-identifiers
https://grapheneos.org/faq#non-hardware-identifiers

Examples of the global OS configuration available to apps are time zone, network country code and other similar global settings. Per-profile examples are dark mode and language. Similar to extension and browser configuration / state being fingerprinted by web sites, an app could use a combination of these things in an attempt to identify the installation. All of these things vary at runtime and can be changed, but some are fairly unlikely to change in practice after the initial setup of the device such as the ones listed above.

If you want to use an app for different purposes without those being tied to the same device, separate profiles are the recommended method. Some types of fingerprinting may still be possible though.

The most private method would be to actually use a different device.

Eumenia

Probably9857 Examples of the global OS configuration available to apps are time zone, network country code and other similar global settings. Per-profile examples are dark mode and language.

Timezone is a large scope of several hundred million people and I think that is not necessary for the app to sahre this info with the backend server.

Network country code can be obfuscated through VPN/Tor, or am I'm wrong?

What are these other global settings?

Dark Mode is an info they get bit I don't think that this tells the app much, cause this is only 1bit of information.

Language could be a tracking factor depending on the how common the language is.
My language is middle common, but I switched to English (USA) to make get a more common language.

Probably9857

Eumenia Network country code can be obfuscated through VPN/Tor, or am I'm wrong?

You are wrong. Apps can get the country code from the SIM via getSimCountryIso, as well as from the cellular network via getNetworkCountryIso. The latter method works even without a SIM, if you are not in airplane mode.

Eumenia What are these other global settings?

These are just the examples from the GrapheneOS FAQ. I'm not aware of any comprehensive list.

DeletedUser433

Eumenia If you're talking about the importance of knowing the time-zone when profiling users, unless you're excluding everyone outside a specific country, it can be a very important identifier especially if you're working in dangerous areas. The time-zone alone may not be enough but in a combination with other data it could be very risky

Outside profiling knowing the time-zone is likely just to make things more convenient for the end-user

Eumenia

Probably9857 You are wrong. Apps can get the country code from the SIM via getSimCountryIso, as well as from the cellular network via getNetworkCountryIso. The latter method works even without a SIM, if you are not in airplane mode.

Sounds like there are many things that need to be patched

Ilgar

Apps can get the country code from the SIM via getSimCountryIso, as well as from the cellular network via getNetworkCountryIso. The latter method works even without a SIM, if you are not in airplane mode.

Probably9857 Thank you.

Eumenia Yeah.