Hacker News Reader

Comment by curiousgal | Hacker News Reader

I mean apps already have access to your device ID, no?

They don't - without special permissions on newer Android versions (10+). There is an ANDROID_ID but it's scoped to your application on Android 8.0+, reinstalling the same app signed with same key will give you the same key but it returns a different value in other apps. This way you can't use for cross-app tracking.

https://developer.android.com/training/articles/user-data-id...

https://developer.android.com/reference/android/provider/Set...

How does Google share logins between different apps then? Is there some shared keybag/storage location that only works for the developer's own apps (and is it scoped to the actual developer account, not one that different developers can collude to use together)?

I am not sure what mechanism is Google using. But Android apps can talk to each other on the same device and you can restrict this to only applications that are signed with the same certificate (and this is guarded at the OS level).

>How does Google share logins between different apps then?

google play services

It seems that you don't use Android. There's an account system apps can use in the os.

Just checked mine, I can see Google, Facebook, Reddit and quite a lot others there

Apps that have the same signing keys can share code and data: https://developer.android.com/studio/publish/app-signing#con...

However, the restriction only apply to asop/pixel devices. For other devices, often there is a way to extract unique id/ imei with hidden api without any premissions.

Reply on news.ycombinator.com