6 ms·

How Google tracks Android device users before they've even opened an app

95 points by owendarko 2y ago

exabrial 2y ago
Silicon Valley has no concept of willful consent.
- owendarko 2y ago
  *Big Tech Silicon Valley, I'd say.
  - 9283409232 2y ago
    No. Silicon Valley as a whole. There are no good guy tech companies because if they were they would be out of business. If there are, let me know because I want to work for them.
- shadowgovt 2y ago
  One could contrast, say, the etiquette and tech of the Fediverse. ... even then, I question if the rhetoric matches the reality. Many users of Mastodon, for instance, will decry the harvesting of data or creation of search engines, then run what is essentially an open relay of every post their users create to any other node that purports to be a legit Mastodon instance. The organic growth goal conflicts with the data-control goal. When your technology's operation doesn't match the rhetoric, which is it?
- knowitnone 2y ago
  I'd say that about all companies and even individuals, not just Silocon Valley.
exabrial 2y ago
I’m ready for a third operating system, not tied to an advertising company, where you have root access to inspect them system, revenue is generated through OS refreshes and SDK licensure. To this day, I can’t believe that an _operating system _ has provisions in it for advertising.
- LorenDB 2y ago
  Linux? You won't have all your apps (unless you get Waydroid working, but that itself relies on an Android image), but it does work well enough that some people daily-drive it.
- shadowgovt 2y ago
  Advertising is very, very lucrative. Hard to resist tapping that vein when it's sitting right there and most users don't even feel it.
Havoc 2y ago
Adtech company doing adtech things.
rany_ 2y ago
> Another tracker which cannot be removed once created is the Google Android ID, a device identifier that's linked to a user's Google account and created after the first connection made to the device by Google Play Services. The Android ID isn't actually unique anymore. Every app you install will see a different Android ID. https://android-developers.googleblog.com/2017/04/changes-to-device-identifiers-in.html?m=1 https://android-developers.googleblog.com/2017/04/changes-to...
- taneq 2y ago
  That stops apps tracking you, it doesn't stop Google tracking you.
- soperj 2y ago
  What if you have multiple google accounts?
  - gruez 2y ago
    It's stored on a per-user basis. Note "user" refers to the operating system user, not the logged in google account. >In versions of the platform lower than Android 8.0 (API level 26), a 64-bit number (expressed as a hexadecimal string) that is randomly generated when the user first sets up the device and should remain constant for the lifetime of the user's device. On devices that have multiple users, each user appears as a completely separate device, so the ANDROID_ID value is unique to each user. https://developer.android.com/reference/android/provider/Settings.Secure#ANDROID_ID https://developer.android.com/reference/android/provider/Set...
- croes 2y ago
  A new ID for every app doesn’t mean it’s not unique.
  - rany_ 2y ago
    Yes, the ID is unique per-app+user BUT the ID would then be useless for tracking you across apps. It is no different from the app itself creating a random ID and saving it.
everdrive 2y ago
I think a lot of non-technical users really don’t understand the distinction between how the OS vs. how any given app can spy on you. Even in technical circles, this issue gets confused. Is Android or iOS better for privacy? Well, modern Android (arguably) gives you better privacy controls for apps, however Android OS itself performs an order of magnitude more spying that iOS does.
- gruez 2y ago
  >Well, modern Android (arguably) gives you better privacy controls for apps compared to iOS? in what way?
- hulitu 2y ago
  > Android OS itself performs an order of magnitude more spying that iOS does. Citation needed. (and no, Apple's promises do not count). iOS seems very pushy to turn on every time online services and bluetooth.
  - 9283409232 2y ago
    This[1] is a paper that shows what each operating system tracks and what security model they use. Android generally tracks more and has less effective sandboxing. [1] https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=101f723d06082a6c06d327077607aded1e5c7a56 https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&d...
    - gruez 2y ago
      The paper you linked is absolutely trash. The actual "meat" of the article is only two pages, and contains nothing of substance, presumably because the authors themselves admit it's "secondary research where we have collected the data from IEEE Xplore and Wikipedia". It also contains some hilariously bad takes like that Android "is not fully stable because as android is free ware". As for the claim that it has less effective sandboxing, that's just a claim taken at face value from an article from 2014 and is no way indicative of how secure iOS or Android is today.
princevegeta89 2y ago
Recently, I thought Maps was the app that tracks me everywhere I go. I put Maps in Incognito mode just as an attempt to disable it, but guess what? It still tracked me all the time. The only difference Incognito made was not remember my search history
- dredmorbius 2y ago
  Google settled a $5 billion class action lawsuit over this fact in 2023, though to little practical effect: <https://apnews.com/article/google-incognito-mode-tracking-lawsuit-settlement-8b30c9397f678bc4c546ab84191f7a9d https://apnews.com/article/google-incognito-mode-tracking-la...> Yes, "Incognito" largely only removes local activity history, doing little if anything to disable remote tracking. Though there's some (very slight) advantage in having cookies and the like be made temporary. Access to other identifiers, including Google's ad identity and device-specific identifiers is probably still available. (I'm hazy on this and the situation changes, though at a ground level capacity-to-track largely remains intact over time).
danpalmer 2y ago
There's a significant amount of guesswork in this Register article. PCC[0] is an example of on-device compute being done in a way to ensure Google (and others) don't see certain kinds of data. [0]: https://security.googleblog.com/2022/12/trust-in-transparency-private-compute.html https://security.googleblog.com/2022/12/trust-in-transparenc...
fallinditch 2y ago
If it takes research by a leading academic to uncover this device behavior then what hope is there for us mere morals who don't want their identity to be tracked and traded? Is it impossible to use a smart phone with strict privacy, or just very difficult?
- Am4TIfIsER0ppos 2y ago
  > Is it impossible to use a smart phone with strict privacy? Yes. It is a surveillance device pushed by government for this reason.
  - shadowgovt 2y ago
    It's also a surveillance device in its design. The mechanism of it is to connect to one or more third-party-owned towers to bidirectionally transpond data. By the nature of the machine, calculating roughly where the machine is every time it transponds is very straightforward. "I want to send and receive messages from you but you're not allowed to know anything about me" is, at first pass, a tall order. We can sort of get that from the postal system and very little else in terms of communications technologies (and even then, if you screw with the network the postal service in the US is empowered federally to hunt you down).
  - master-lincoln 2y ago
    What makes you believe it is pushed by government (and which government?) and why do you think that government wants to collect private info of everybody without letting them know and is there any evidence for it? Sorry for all these questions, but without them answered your claim sounds like a conspiracy theory.
    - fifticon 2y ago
      in my country there are plenty of critical services you basically can't access without mobile apps. e.g. interacting with medical services, and official personal id app.
    - 2y ago
deleted 2y ago
[deleted]
dredmorbius 2y ago
Can anyone ELI5 what the situation with the Android ID is when no Google account has ever been created, and all app installs are through an alternative store interface, whether a front-end to Google Play (e.g., Aurora) or a freestanding store (e.g., FDroid)?
- gruez 2y ago
  It's generated by the operating system itself, not google play services. So being logged into a google account or not doesn't affect the value. There's also a gsf id which is generated by google play services, but that's generated regardless of whether you're signed in or not. https://stackoverflow.com/questions/65649831/two-different-android-ids-settings-secure-aml-settings-ssaid-xml https://stackoverflow.com/questions/65649831/two-different-a...
  - dredmorbius 2y ago
    Thanks!
knowitnone 2y ago
Google owns the whole OS so expect that they are tracking you 100% of the time. Same with Microsoft.

95 points by owendarko 2y ago

exabrial 2y ago

Silicon Valley has no concept of willful consent.

owendarko 2y ago
*Big Tech Silicon Valley, I'd say.
- 9283409232 2y ago
  No. Silicon Valley as a whole. There are no good guy tech companies because if they were they would be out of business. If there are, let me know because I want to work for them.
shadowgovt 2y ago
One could contrast, say, the etiquette and tech of the Fediverse. ... even then, I question if the rhetoric matches the reality. Many users of Mastodon, for instance, will decry the harvesting of data or creation of search engines, then run what is essentially an open relay of every post their users create to any other node that purports to be a legit Mastodon instance. The organic growth goal conflicts with the data-control goal. When your technology's operation doesn't match the rhetoric, which is it?
knowitnone 2y ago
I'd say that about all companies and even individuals, not just Silocon Valley.

exabrial 2y ago

I’m ready for a third operating system, not tied to an advertising company, where you have root access to inspect them system, revenue is generated through OS refreshes and SDK licensure. To this day, I can’t believe that an _operating system _ has provisions in it for advertising.

LorenDB 2y ago
Linux? You won't have all your apps (unless you get Waydroid working, but that itself relies on an Android image), but it does work well enough that some people daily-drive it.
shadowgovt 2y ago
Advertising is very, very lucrative. Hard to resist tapping that vein when it's sitting right there and most users don't even feel it.

Havoc 2y ago

Adtech company doing adtech things.

rany_ 2y ago

> Another tracker which cannot be removed once created is the Google Android ID, a device identifier that's linked to a user's Google account and created after the first connection made to the device by Google Play Services. The Android ID isn't actually unique anymore. Every app you install will see a different Android ID. https://android-developers.googleblog.com/2017/04/changes-to-device-identifiers-in.html?m=1 https://android-developers.googleblog.com/2017/04/changes-to...

taneq 2y ago
That stops apps tracking you, it doesn't stop Google tracking you.
soperj 2y ago
What if you have multiple google accounts?
- gruez 2y ago
  It's stored on a per-user basis. Note "user" refers to the operating system user, not the logged in google account. >In versions of the platform lower than Android 8.0 (API level 26), a 64-bit number (expressed as a hexadecimal string) that is randomly generated when the user first sets up the device and should remain constant for the lifetime of the user's device. On devices that have multiple users, each user appears as a completely separate device, so the ANDROID_ID value is unique to each user. https://developer.android.com/reference/android/provider/Settings.Secure#ANDROID_ID https://developer.android.com/reference/android/provider/Set...
croes 2y ago
A new ID for every app doesn’t mean it’s not unique.
- rany_ 2y ago
  Yes, the ID is unique per-app+user BUT the ID would then be useless for tracking you across apps. It is no different from the app itself creating a random ID and saving it.

everdrive 2y ago

I think a lot of non-technical users really don’t understand the distinction between how the OS vs. how any given app can spy on you. Even in technical circles, this issue gets confused. Is Android or iOS better for privacy? Well, modern Android (arguably) gives you better privacy controls for apps, however Android OS itself performs an order of magnitude more spying that iOS does.

gruez 2y ago
>Well, modern Android (arguably) gives you better privacy controls for apps compared to iOS? in what way?
hulitu 2y ago
> Android OS itself performs an order of magnitude more spying that iOS does. Citation needed. (and no, Apple's promises do not count). iOS seems very pushy to turn on every time online services and bluetooth.
- 9283409232 2y ago
  This[1] is a paper that shows what each operating system tracks and what security model they use. Android generally tracks more and has less effective sandboxing. [1] https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=101f723d06082a6c06d327077607aded1e5c7a56 https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&d...
  - gruez 2y ago
    The paper you linked is absolutely trash. The actual "meat" of the article is only two pages, and contains nothing of substance, presumably because the authors themselves admit it's "secondary research where we have collected the data from IEEE Xplore and Wikipedia". It also contains some hilariously bad takes like that Android "is not fully stable because as android is free ware". As for the claim that it has less effective sandboxing, that's just a claim taken at face value from an article from 2014 and is no way indicative of how secure iOS or Android is today.

princevegeta89 2y ago

Recently, I thought Maps was the app that tracks me everywhere I go. I put Maps in Incognito mode just as an attempt to disable it, but guess what? It still tracked me all the time. The only difference Incognito made was not remember my search history

dredmorbius 2y ago
Google settled a $5 billion class action lawsuit over this fact in 2023, though to little practical effect: <https://apnews.com/article/google-incognito-mode-tracking-lawsuit-settlement-8b30c9397f678bc4c546ab84191f7a9d https://apnews.com/article/google-incognito-mode-tracking-la...> Yes, "Incognito" largely only removes local activity history, doing little if anything to disable remote tracking. Though there's some (very slight) advantage in having cookies and the like be made temporary. Access to other identifiers, including Google's ad identity and device-specific identifiers is probably still available. (I'm hazy on this and the situation changes, though at a ground level capacity-to-track largely remains intact over time).

danpalmer 2y ago

There's a significant amount of guesswork in this Register article. PCC[0] is an example of on-device compute being done in a way to ensure Google (and others) don't see certain kinds of data. [0]: https://security.googleblog.com/2022/12/trust-in-transparency-private-compute.html https://security.googleblog.com/2022/12/trust-in-transparenc...

fallinditch 2y ago

If it takes research by a leading academic to uncover this device behavior then what hope is there for us mere morals who don't want their identity to be tracked and traded? Is it impossible to use a smart phone with strict privacy, or just very difficult?

Am4TIfIsER0ppos 2y ago
> Is it impossible to use a smart phone with strict privacy? Yes. It is a surveillance device pushed by government for this reason.
- shadowgovt 2y ago
  It's also a surveillance device in its design. The mechanism of it is to connect to one or more third-party-owned towers to bidirectionally transpond data. By the nature of the machine, calculating roughly where the machine is every time it transponds is very straightforward. "I want to send and receive messages from you but you're not allowed to know anything about me" is, at first pass, a tall order. We can sort of get that from the postal system and very little else in terms of communications technologies (and even then, if you screw with the network the postal service in the US is empowered federally to hunt you down).
- master-lincoln 2y ago
  What makes you believe it is pushed by government (and which government?) and why do you think that government wants to collect private info of everybody without letting them know and is there any evidence for it? Sorry for all these questions, but without them answered your claim sounds like a conspiracy theory.
  - fifticon 2y ago
    in my country there are plenty of critical services you basically can't access without mobile apps. e.g. interacting with medical services, and official personal id app.
  - 2y ago

deleted 2y ago

[deleted]

dredmorbius 2y ago

Can anyone ELI5 what the situation with the Android ID is when no Google account has ever been created, and all app installs are through an alternative store interface, whether a front-end to Google Play (e.g., Aurora) or a freestanding store (e.g., FDroid)?

gruez 2y ago
It's generated by the operating system itself, not google play services. So being logged into a google account or not doesn't affect the value. There's also a gsf id which is generated by google play services, but that's generated regardless of whether you're signed in or not. https://stackoverflow.com/questions/65649831/two-different-android-ids-settings-secure-aml-settings-ssaid-xml https://stackoverflow.com/questions/65649831/two-different-a...
- dredmorbius 2y ago
  Thanks!

knowitnone 2y ago

Google owns the whole OS so expect that they are tracking you 100% of the time. Same with Microsoft.