Two questions regarding the unholy trinity from Google

de0u

User2288 Copying over an installed program from main profile to others always has the chance to copy over any hard coded unique identifiers.

That is an interesting threat class. Have app stores been observed to watermark APK files?

User2288 My requests in getting any information on this from the GOS team have gone unanswered so far.

What information has been requested?

User2288

de0u Have app stores been observed to watermark APK files?

Don't know. I initially heard of this idea in regards to downloaded exe files for windows environment. That downloaded exe installer files can be embedded with a unique identifier on each download which creates a tracking method for the app developer to trace a download instance. Later on I heard it echoed a few times on this forum about this possibility in apks.

de0u What information has been requested?

This post is what I'm referring to.
https://discuss.grapheneos.org/d/7800-how-to-mitigate-identifiability-from-google-accessing-installed-apps/9

Note that the concept itself could theoretically apply to google play files themselves, as generally google tries to attach unique identifiers to almost everything it can.

de0u

User2288 I initially heard of this idea in regards to downloaded exe files for windows environment. That downloaded exe installer files can be embedded with a unique identifier on each download which creates a tracking method for the app developer to trace a download instance. Later on I heard it echoed a few times on this forum about this possibility in apks.

Watermarking executables is indeed technically possible. It's also inherently detectable: if two people download the same app from the same app source onto devices of the same type running the same OS version, and the APKs differ, the source is probably watermarking. The check isn't computationally expensive.

I wouldn't be surprised if payment-based stores watermarked apps. Maybe Apple's does? I found a discussion on StackOverflow but it didn't seem conclusive to me.

It's possible to imagine a peer-to-peer APK-hash service, sort of like certificate transparency monitoring, that would watch out for this.

User2288

de0u It's possible to imagine a peer-to-peer APK-hash service, sort of like certificate transparency monitoring, that would watch out for this.

That's brilliant.

leafnose

@User2288
Interesting. I guess watermarked APKs or installations are already used in special case, but I hope not massively.
Regarding favouring the installation of Google components through Apps instead of copying them from the Owner profile, is it pure intuition – not a reproach – or is there any kind of documentation?

@router99
No, you’re totally right. It’s better to assume the worst. In a way, it’s a good thing to know the limits of a given device; better than having a false sense of anonymity.

@de0u
I tested fingerprintjs on a Pixel 7a.
Under the Device Fingerprint tab, no string is the same after a factory reset, which contrast with my Pixel 8 test.

However, under the Device ID tab, the Media DRM ID is, again, factory-reset-resistant.

Should I edit my Github message, add a new message, or nothing?

User2288

leafnose is it pure intuition – not a reproach – or is there any kind of documentation?

Intuition. Definitely no evidence. Just putting 2 and 2 together.

The suggestion is not that "this IS the case". The suggestion is that " it COULD be" the case. The technical ability exists.

de0u

leafnose Should I edit my Github message, add a new message, or nothing?

If I am correctly understanding that the fingerprint is stickier with the P8 than with the P7a, i.e., the evidence that is worse is already in the ticket, given that a developer has already assumed the ticket it might be best to let it sit for a while longer before adding more traffic. Maybe mid-January?

Meanwhile, my hunch is that perceived urgency would be increased by a demonstration (by anybody) that a web site can remotely fetch the same Media DRM i.d. from a device across a factory reset (along with a demo that two different devices of the same model number get different i.d.'s). I don't know how complicated it might be to code up such a web site, or if one of the available fingerprint web sites already does this. If solid evidence (not just articles online) is available for this, I think it would be fine to add it to the issue.

leafnose

User2288 Totally agree. Also, since the baddies are always at least one step ahead, better safe than sorry I guess.

« Previous Page