So, we’ve seen Loupe, the FOSS tool that allows people to check what data points apps can access on an iPhone without any permissions. Here’s a similar tool for Android, called AndroWatch, which does exactly the same: it simply shows which data points all of your installed apps can access to try & fingerprint your current device & profile.
This app got posted on the GrapheneOS forum a few hours ago in this post. Just tested it out myself & I wanted to share it here too.
All I can say is that I’m feeling pretty pessimistic about the state of mobile privacy now, even on GrapheneOS where I tested this. While GOS does block a few of the data categories compared to stock AOSP, there’s still way too many data points available for apps, most of which are relatively static too, allowing for devices to be fingerprinted reliably. And with the GOS team’s resources already stretched thin, their priorities are in different, more high-value targets; so hoping them to patch up all of these holes might take a while longer.
Perhaps this could act as a reminder for all of us Android/GOS folks to not install untrustworhty apps & to prefer webapps where reasonable if we wish to preserve our privacy.
Check the app out if you want to feel disappointed about mobile privacy too.
I am not affiliated with this project at all. I just found it & wished to share it here.
Yes, this has been common knowledge for some time and as said above it is not necessarily unique to mobile devices:
There’s no claimed protection against fingerprinting by native apps by Android or GrapheneOS… Native apps are inherently able to fingerprint in many different ways and it’s unrealistic to bring it to the same level as web pages without running apps in a standardized virtual machine with more limited functionality than they currently have available. There has only recently started being any significant progress on mitigating fingerprinting for the web and the same thing has barely begun for native app environments. The difference in the starting points is also significant.
&
There are various ways that apps in different profiles can get indication they are running on the same device. Private Space is another type of profile as are work, user and cloned profiles.
…
Some techniques work better if profiles are running at the same time. Others would require recording the data over time to provide a strong correlation. It would not take long.
…
Currently GrapheneOS is disinclined to provide blocking for only one or a few of these, in an attempt to stop fingerprinting, as it would still be relatively trivial for apps to continue to achieve strong confidence that they are running on the same device if they so desire. It may also give the impression to users that they can not do that.
Also note:
Even the most strict anti-fingerprinting features deployed for web browsers don’t prevent doing it via JavaScript-based timing measurements to measure performance along with other side channels.