Is it safe to use the ANDROID_ID as user credential?

user_11782204 0
Viewed 106

I would like to make an application without registration and if possible, when the user uninstalls and reinstalls the application, be logged in again.

I could read that there is the ANDROID_ID which never changes.

But then, I ask myself a question: Is it safe to use ANDROID_ID as a way to connect the user?

I've read that starting with android 8.0, the behavior of ANDROID_ID has changed and is now generated based on the bundle and the signature of the application. But before android 8.0, isn't there a security issue due to the fact that, if I understand correctly, all applications share the same ANDROID_ID?

authentication android security
1 Answers

there are known devices/models which were distributed to the market with same ANDROID_ID, so this way isn't safe to use as auto-login param. Android team noticed that setting ANDROID_ID by hardware producer isn't reliable, thus changed this behavior in Oreo, so on devices with 8.0+ its reliable, on lower isn't

note that even on Oreo and later ANDROID_ID MAY change e.g. when system is updated and your app will be uninstalled (different id before and after OS update)

edit due to comment:

well, on Oreo+ devices I think you can rely on ANDROID_ID - OS updates are rare and also there is a really small chance that someone uninstall your app, gets OS update and then install again your app...

for older devices I've done similar feature like you need few years ago - I was storing some data on external storage (sd card or internal) in hidden folder (Linux, so . before name is sufficient). after app (re)install I was looking at first for saved data and restoring if found. it may be some ANDROID_ID equivalent + maybe some cryptography or checksum-integrated for more inquisitive users... this approach will work on older devices, on which storage access policy is pretty "loose". newer OS version releases were introducing new limitations in this topic, e.g. Scoped Storage in Android 10. you can still have access to "raw"/all data stored on sd/internally, but you need some permissions and this may look suspicious to the user and prevent installing (imho correct approach). but on Android 7 and lower I think you can "find a place" to store some hidden/encrypted data for restoring later ;) note that this way may even "rescue" your app when user wipe out all data

some docs about (persistent or not) storing data in HERE. you can find there useful table with Files removed on app uninstall? column and more info about storing and limitations. good luck :)

user_42176820
Related