Pith. sign in

REVIEW 3 major objections 6 minor 71 references

Fingerprinting SDKs for Mobile Apps and Where to Find Them: Understanding the Market for Device Fingerprinting

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Advertising SDKs account for only about 30 percent of likely fingerprinting behavior in mobile apps, so privacy rules that target ads alone cover less than a third of the problem.

desk verdict A careful, large-scale measurement of fingerprinting-like SDK behavior whose headline market shares are honestly caveated but remain seed-dependent point estimates. read the letter →

arxiv 2506.22639 v1 pith:266PPCXY submitted 2025-06-27 cs.CR

Michael A. Specter , Mihai Christodorescu , Abbie Farr , Bo Ma , Robin Lassonde , Xiaoyang Xu , Xiang Pan , Fengguo Wei
show 2 more authors
Saswat Anand Dave Kleidermacher
This is my paper
classification cs.CR
keywords devicefingerprintingmobileSDKsAndroidappsstatictaintanalysisadvertisingprivacypolicytrackingtransparencySDKmarketmeasurement
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to map the market for device fingerprinting in mobile apps by measuring which third-party software libraries (SDKs) collect enough device data to identify a user. It finds that advertising SDKs, the current focus of industry privacy rules, produce only 30.56% of likely fingerprinting behaviors, while SDKs whose purpose cannot be determined from public information produce 23.92%, the second-largest share. The paper argues that privacy interventions aimed only at advertising therefore offer incomplete benefit, and that the diversity of signals and APIs used by fingerprinters makes API-level or permission-based enforcement brittle. If the results hold, they imply that effective anti-fingerprinting policy needs to address analytics, security, and tool SDKs as well as ads, and to demand better transparency about what SDKs do.

What carries the argument

The central mechanism is a seed-set threshold static analysis pipeline. The paper starts with 14 SDKs that openly advertise fingerprinting, manually reverse-engineers them to extract 504 unique exfiltrated signals, then uses a taint-flow analysis (called CoFlow) to flag any SDK that sends at least 20 such signals (the minimum observed in the seed set) to a common sink, either a network API or an encryption function. This yields the Extended Set of 723 fingerprinting-like SDK families, which are then labeled by a team of coders into five purpose categories. The machinery operationalizes fingerprinting behavior as exfiltrating more device signals than a self-confessed fingerprinter does, rather than relying on stated intent.

What would settle it

Run the same pipeline with a seed set that includes advertising SDKs that openly admit to fingerprinting; if those SDKs exfiltrate meaningful numbers of signals absent from the current 504-signal vocabulary, the Extended Set composition and the 30.56% Ads share would shift, undermining the conclusion that ad-targeted interventions cover under a third of fingerprinters.

Watch

Extended reading notes

Core claim

The central claim is that the fingerprinting ecosystem is broader and more opaque than previous work suggested: of 723 SDK families that exfiltrate at least as many device signals as the least-collecting self-identified fingerprinting SDK, only 221 (30.56%) are advertising SDKs, while 173 (23.92%) have unknown or unclear purpose, 167 are tools or other, 85 are security and authentication, and 77 are analytics. The paper also discovers that the signal space is sparse: only 2% of exfiltrated APIs are shared by more than 75% of likely fingerprinting SDKs, so no small set of permissions or APIs can cleanly separate fingerprinters from legitimate libraries. It further finds that fingerprinting SDKs are disproportionately popular, with roughly 10 times more installs than non-fingerprinting alternatives, and that a user installing a popular app in categories like comics, games, or dating has an 80+% chance of encountering one.

Load-bearing premise

The whole measurement rests on the assumption that the 14 self-identifying fingerprinting SDKs, which are all security or anti-fraud products and none of which is an advertising SDK, use signal types representative of every SDK that fingerprints, so an SDK is only counted once it exfiltrates signals from that vocabulary.

Editorial extensions

If this is right

  • Industry anti-tracking interventions that apply only to advertising SDKs, such as app tracking transparency and privacy sandbox rules, would leave out roughly two-thirds of SDK families that exhibit fingerprinting-like behavior.
  • The large Unclear/Not Found share (23.92%) means current SDK metadata is too sparse for policy enforcement, and behavioral analysis alone cannot determine purpose; out-of-band labeling is needed.
  • Permission- or API-based defenses are likely to be brittle: because signals are sparse and diverse, blocking a handful of APIs would push fingerprinters to other entropy sources, and only 2% of APIs are used by more than 75% of likely fingerprinting SDKs.
  • Since likely fingerprinting SDKs are disproportionately popular (about 10x more installs), users of popular apps, especially in games, dating, and comics, have a high probability (80+%) of being exposed to device fingerprinting.
  • If advertising and security/authentication SDKs cannot be reliably separated by their exfiltrated signals (as the visualization suggests), automatic enforcement that tries to allow anti-fraud tracking while blocking ad tracking will require classifiers beyond simple permissions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct extension of this result is that the same market composition likely holds on other mobile platforms, because every seed SDK has an iOS version; this would mean privacy rules on iOS also miss the unknown-SDK share.
  • The concentration of fingerprinting in analytics and tools suggests that privacy-preserving alternatives for analytics, such as differential privacy or on-device aggregation, could reduce the need to collect raw device signals.
  • A testable extension would weight the 504 signals by their actual entropy or uniqueness; doing so could either raise or lower the count of likely fingerprinters and shift the category shares.
  • The sparse-signal finding implies that defenses relying on known fingerprinting API patterns could be evaded by choosing less common signal combinations, so a robust defense would need to reason about the joint entropy of collected data.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper presents a large-scale empirical study of device-fingerprinting behavior in Android SDKs. The authors collect 228,598 SDKs from Maven repositories and 178,054 active Google Play apps, manually identify 14 self-declared fingerprinting SDKs (the Seed Set) and extract the 504 distinct signals they exfiltrate, then use a static taint/CoFlow analysis to detect SDKs that exfiltrate at least as many signals as the weakest Seed Set member (about 20) to a common network sink, producing an Extended Set of 723 SDK families. These are manually labeled (Ads, Analytics, Security/Authentication, Tools/Other, Unclear/Not Found) with a Krippendorff's alpha of 0.804. The headline finding is that Ads SDKs account for only 30.56% of the likely-fingerprinting SDK families, while 23.92% come from SDKs whose purpose is unknown or unclear; this motivates the policy conclusion that advertising-focused interventions such as ATT and Privacy Sandbox may address well under a third of fingerprinting behavior. The paper also reports app-category prevalence, cross-app sharing of fingerprinting SDKs, and signal sparsity.

Significance. If the headline shares are accurate, the paper makes a substantial empirical contribution: it is the largest SDK-level measurement of fingerprinting-like behavior to date and provides the first market-composition breakdown showing that fingerprinting extends well beyond advertising SDKs. The methodology has real strengths: two-analyst manual verification of the seed SDKs, a deliberately conservative inclusion threshold framed as an upper-bar estimate, inter-rater reliability of 0.804 for labeling, and a systematic evaluation of the app-SDK matcher with ground truth (99.89% precision at 46.16% recall on a restricted set). The detailed appendices describing the taint analysis, CoFlow detection, SDK-matching algorithm, and codebook are a useful resource for replication and follow-up work. The central policy conclusion, however, depends on the representativeness of the 14-SDK seed set and the stability of the resulting Extended Set; these are not yet demonstrated with sensitivity analysis, so the quantitative shares should be treated as provisional.

major comments (3)
  1. [§3.2–§3.3 / Figure 4 / Abstract] The headline market-composition claim (Ads 30.56%, Unclear 23.92%) is computed from an Extended Set defined entirely by the 504-signal vocabulary manually extracted from 14 Seed Set SDKs, none of which is an advertising SDK (Table 2). The detection pipeline recognizes only exfiltration of these seed-derived signals, so any ad SDK that fingerprints using a different signal set (e.g., app-usage timing, sensor contexts, or ad-identifier-related attributes not in the seed list) cannot be included in the Extended Set. The paper itself concedes this in §5.1: 'It may be that SDKs that fingerprint for hidden reasons use alternative techniques, which would not be caught in our later analyses.' No sensitivity analysis is reported, so the 30.56% point estimate has no quantified uncertainty. A concrete test would be to add several well-known advertising SDKs to the seed set, re-run signal extraction and CoFlow detection, and report how the category shares shift; at a minimum, the authors should report the share range as the inclusion threshold varies around the 20-signal cutoff. Without this, the abstract's conclusion that advertising-focused interventions reach under a third of fingerprinting SDKs is not yet supported.
  2. [§3.3 / Appendix B (Fingerprinting Detection)] The CoFlow-based fingerprinting detector that produces the Extended Set is not validated against ground-truth labels on the wider SDK corpus. The authors manually verified only the 14 Seed Set SDKs; no precision/recall evaluation is reported for the detector's classification of the remaining 228,000+ SDKs, even though all of RQ2 and the market-share percentages depend on that classification. The paper calls the approach 'conservative' and an 'upper-bar estimate,' but a conservative threshold does not by itself establish that the 723-family Extended Set is not substantially contaminated by false positives or missing many true fingerprinters. I recommend manually labeling a random sample of Extended Set and non-Extended Set SDK families (or otherwise constructing a validation set) and reporting detector precision and recall, together with the distribution of N (the number of flows reaching a sink). This would also ground the claim that the pipeline provides an upper bar for the set of fingerprinting-like SDKs.
  3. [§4.3 / Appendix C / Figures 6 and 7] The app-level prevalence results (e.g., 39.4% of apps in a category contain a fingerprinting SDK; cross-category sharing probabilities) rest on the SDK-matching algorithm whose published evaluation shows 99.89% precision at 46.16% recall on the restricted 9,683-SDK set, and 65.07% average precision on the larger 302,397-SDK set. The paper correctly describes these as lower bounds, but the magnitude of the undercount is not quantified: a 46% recall on the restricted set implies that the true market reach of fingerprinting SDKs could be substantially higher than the reported 3.2%–10% app prevalence and the cross-app sharing probabilities could be materially understated. I would like the authors to either report recall and precision stratified by SDK category (e.g., for Ads vs. Unclear SDKs) or provide a calibrated correction factor that turns the lower bound into a range. This issue is load-bearing for RQ3, which is one of the paper's three stated research questions, even if it is secondary to the RQ2 market-composition claim.
minor comments (6)
  1. [Abstract / §1] The abstract and §1 say 'at least 20 signals exfiltrated per SDK,' but §3.3 states the criterion is 'more than the lowest number of signals collected by any SDK in our Seed Set' (i.e., more than 20). Please make the threshold wording consistent (strictly greater vs. at least).
  2. [§3.1] The text says the crawl covered '9 separate large-scale Maven repositories' but lists only eight names: JCenter, Maven Central, Google, Sonatype, Spring.io, Jitpack, Bintray, and Artifactory. Please add the missing repository or correct the count.
  3. [Table 2] The table lists 'ThreatMetrix (Lexus Nexus)' — the company name is LexisNexis. Please correct the spelling.
  4. [§4.2] The sentence 'Only only 6.15% record account-list signals' contains a duplicated 'only.' Please fix the typo.
  5. [§5.1 / External validity] The phrase 'our choice of actual SDKs from popular Maven repositories and mobile apps from the Google Play store ensure minimize this risk' is ungrammatical; likely 'ensure we minimize' or 'help minimize' was intended.
  6. [§4.2 / Figure 5] The t-SNE interpretation (e.g., 'the right third of the t-SNE plot contains most of the Security and Authentication SDKs') is based on a stochastic embedding with a single run; please report at least the stability of the visual clusters across multiple t-SNE runs or add a quantitative cluster-separation metric, since the text uses this figure to support the claim that distinguishing Ads from Security/Authentication SDKs is nontrivial.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the market-composition claim is an acknowledged seed-dependent measurement, not a self-referential derivation.

full rationale

The paper's load-bearing market-composition claim (Ads 30.56%, Unclear 23.92%, etc., §4.2 / Fig. 4) is a descriptive measurement over the Extended Set, which the paper explicitly constructs as SDKs that exfiltrate more than the minimum seed-SDK signal count (~20) of the 504 signals manually extracted from the 14 self-identifying Seed Set SDKs (§3.2–§3.3). This construction makes the measurement dependent on the seed's signal vocabulary and on the 20-signal threshold; the paper itself acknowledges the resulting coverage limitation: 'It may be that SDKs that fingerprint for hidden reasons use alternative techniques, which would not be caught in our later analyses' (§5.1). That is a selection-bias / external-validity threat, not a circularity: the category shares are not defined in terms of themselves, no parameter fitted to a subset is later presented as a prediction, and no load-bearing result is justified by a self-citation. The self-citations present (e.g., [33] on API proxying; [42] on Android security model) are background and do not carry the argument. The sparse-signal observations are empirical statements about the seed-derived API set, not equations reducible to the seed's definition. Accordingly, no circular step is identified.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The quantitative claims rest on one calibration choice and one labeling effort. The calibration choice is the about-20-signal threshold tied to the seed minimum (§3.3); everything downstream, the 723 families, the 30.56% ads share, and the 23.92% unknown share, inherits it. The labeling effort (§3.4) is independent of detection and well documented, with inter-rater agreement 0.804 on the codebook, but only 723 families were labeled, and labels come from public metadata that is itself incomplete, which is exactly why 24% of the set is 'Unclear / Not Found'. Market reach additionally depends on the SDK-matching thresholds in Appendix C, calibrated toward precision at the cost of recall (46.16% recall on one benchmark) and interpreted, appropriately, as lower bounds. The assumption fragile enough to change the headline is seed representativeness: most of the 14 seed SDKs are security, anti-fraud, or identity products, none is an advertising SDK, and the signal vocabulary is extracted only from these 14. No new entities are postulated in the paper.

free parameters (6)
  • Extended Set inclusion threshold = About 20 signals (more than the minimum in the Seed Set)
    §3.3: an SDK counts as fingerprinting-like only if it exfiltrates more than the lowest number of signals collected by any Seed Set SDK. Kaspersky's 20 is the minimum, so the bar is about 20 signals to a common sink. This hand-set threshold directly determines the 723 SDK families and hence all market share percentages.
  • App audience cutoff = 10,000 active devices
    §3.1: only apps with over 10,000 active 30-day devices are analyzed, reducing 3,025,417 collected APKs to 178,054. The paper states this avoids biasing with apps lacking a user base; the cutoff choice affects every prevalence statistic.
  • SDK-matching class similarity threshold (eta) = 0.2
    Appendix C: class-level cosine similarity threshold below which an app class is not matched to an SDK class. Chosen 'in our experiments'; affects app-SDK matching precision and recall.
  • SDK-matching class-count threshold (gamma) = 0.55
    Appendix C: minimum fraction of an SDK's classes that must match app classes for the SDK to be declared present. Chosen in experiments; with recall 46.16% on one benchmark, the authors interpret results as lower bounds.
  • Version exclusion set = {alpha, beta, test, dev, debug, qa}
    §3.1: SDK versions whose labels contain these words are excluded from the SDK dataset, which may remove experimental fingerprinting SDKs and slightly change prevalence statistics.
  • Location, app-usage, and account-list signal subsets = 24 location APIs, 3 app-usage APIs, 2 account-list APIs
    §4.2: manually curated sublists of the 504-signal vocabulary used to compute the 72% coarse, 71.6% fine, and 86.29% either-or location claims. These are curation choices, not fitted values, and the claims inherit the seed vocabulary.
assumptions (5)
  • domain assumption Seed Set SDKs self-report honestly: their advertising copy reflects actual fingerprinting behavior
    §5.1: 'We assume that a Seed Set SDK's self-reporting is honest.' The entire signal vocabulary and threshold are built on this.
  • ad hoc to paper SDKs exfiltrating about 20 or more seed-derived signals to a common sink are fingerprinting-like, and SDKs below the bar are not
    §3.3: the central detection rule. The bar is set relative to the seed minimum, so the threshold is an input choice, not an independently validated measure of fingerprinting.
  • domain assumption Static taint/CoFlow analysis and the SDK-matching metric correctly capture runtime exfiltration behavior
    Appendices B and C: analysis covers Java and Android framework flows only; reflection, native code, dynamic loading, and dependency-only flows are excluded, which the paper acknowledges misses some fingerprinting.
  • domain assumption All signals are equally fingerprintable and independent
    §5.1 construct validity: 'we make the simplifying assumption that in-the-wild techniques are largely equivalent, and that there is no relationship between signals collected.' This underpins signal-count-based comparisons such as the 20-signal threshold.
  • domain assumption Manual labels reflect the true purpose of each SDK
    §3.4: labels are assigned from Maven metadata and developer websites, not from code; Krippendorff's alpha 0.804. The central claims about Ads vs Unclear shares rest on these labels.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fingerprinting SDKs for Mobile Apps and Where to Find Them: Understanding the Market for Device Fingerprinting." pith.science (2026). https://pith.science/paper/266PPCXY

@misc{pith2026250622639,
  author       = {Pith},
  title        = {Pith review of: Fingerprinting SDKs for Mobile Apps and Where to Find Them: Understanding the Market for Device Fingerprinting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/266PPCXY}},
  note         = {Machine review of arXiv:2506.22639}
}
read the original abstract

This paper presents a large-scale analysis of fingerprinting-like behavior in the mobile application ecosystem. We take a market-based approach, focusing on third-party tracking as enabled by applications' common use of third-party SDKs. Our dataset consists of over 228,000 SDKs from popular Maven repositories, 178,000 Android applications collected from the Google Play store, and our static analysis pipeline detects exfiltration of over 500 individual signals. To the best of our knowledge, this represents the largest-scale analysis of SDK behavior undertaken to date. We find that Ads SDKs (the ostensible focus of industry efforts such as Apple's App Tracking Transparency and Google's Privacy Sandbox) appear to be the source of only 30.56% of the fingerprinting behaviors. A surprising 23.92% originate from SDKs whose purpose was unknown or unclear. Furthermore, Security and Authentication SDKs are linked to only 11.7% of likely fingerprinting instances. These results suggest that addressing fingerprinting solely in specific market-segment contexts like advertising may offer incomplete benefit. Enforcing anti-fingerprinting policies is also complex, as we observe a sparse distribution of signals and APIs used by likely fingerprinting SDKs. For instance, only 2% of exfiltrated APIs are used by more than 75% of SDKs, making it difficult to rely on user permissions to control fingerprinting behavior.

Figures

Figures reproduced from arXiv: 2506.22639 by the authors.

Figure 1
Figure 1. An overview of our analysis pipeline. We begin by [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Map of signals collected by known fingerprinting SDKs in the Seed Set, with one dot per API exfiltrated. The top plot shows [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 4
Figure 4. Prevalence of purposes across the Extended Set of 723 [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (8 more)
Figure 3
Figure 3. Figure 3: Cosine similarity between Seed Set SDKs, each repre [PITH_FULL_IMAGE:figures/full_fig_p006_3.png]
Figure 5
Figure 5. Figure 5: Map of likely fingerprinting behaviors of SDKs in the Extended Set, computed using t-SNE over embeddings constructed by [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: The number of apps that come with fingerprinting SDKs is rather small, on average at less than 5% of the total number of [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Prevalence of likely fingerprinting SDKs within and across app categories. In (a), the color gradient is computed per app [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Static Taint Analysis – Identify Sources and Sinks [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]
Figure 9
Figure 9. Figure 9: Static Taint Analysis – Taint Propagation [PITH_FULL_IMAGE:figures/full_fig_p016_9.png]
Figure 11
Figure 11. Figure 11: Fingerprinting detection using CoFlow. There are 2 [PITH_FULL_IMAGE:figures/full_fig_p017_11.png]
Figure 12
Figure 12. Figure 12: Features of SDK code are not uniformly distributed [PITH_FULL_IMAGE:figures/full_fig_p018_12.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

71 extracted references · 69 canonical work pages

  1. [1]

    The Privacy Sandbox: Technology for a More Private Web

    * * *. The Privacy Sandbox: Technology for a More Private Web. Available online at https://privacysandbox.com/intl/en_us. Last visited: 2024-09-30

    work page 2024

  2. [2]

    Smartphone fingerprinting combining features of on-board sensors

    Irene Amerini, Rudy Becarelli, Roberto Caldelli, Alessio Melani, and Moreno Niccolai. Smartphone fingerprinting combining features of on-board sensors. IEEE Transactions on Information Forensics and Security, 12(10), 2017

    work page 2017

  3. [3]

    Describing data use in privacy manifests

    Apple. Describing data use in privacy manifests

    work page

  4. [4]

    Describing use of required reason api

    Apple. Describing use of required reason api. Available on- line at https://developer.apple.com/documentation/bundleresources/ privacy_manifest_files/describing_use_of_required_reason_api. Last vis- ited: 2024-09-30

    work page 2024

  5. [5]

    User Privacy and Data Use - App Store

    Apple. User Privacy and Data Use - App Store. Available online at https:// developer.apple.com/app-store/user-privacy-and-data-use/ . Last visited: 2024- 09-30

    work page 2024

  6. [6]

    Reliable third-party library detection in android and its security applications

    Michael Backes, Sven Bugiel, and Erik Derr. Reliable third-party library detection in android and its security applications. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS ’16, page 356–367, New York, NY , USA, 2016. Association for Computing Machinery

    work page 2016

  7. [7]

    Fp-radar: Longitudinal measurement and early detection of browser fingerprinting, 2021

    Pouneh Nikkhah Bahrami, Umar Iqbal, and Zubair Shafiq. Fp-radar: Longitudinal measurement and early detection of browser fingerprinting, 2021

    work page 2021

  8. [8]

    Smartphone verification and user profiles linking across social networks by camera fingerprint- ing

    Flavio Bertini, Rajesh Sharma, Andrea Iannì, and Danilo Montesi. Smartphone verification and user profiles linking across social networks by camera fingerprint- ing. In Joshua I. James and Frank Breitinger, editors, Digital Forensics and Cyber Crime, pages 176–186, Cham, 2015. Springer International Publishing

    work page 2015

Show all 71 references
  1. [9]

    Mobile device identification via sensor fingerprinting, 2014

    Hristo Bojinov, Yan Michalevsky, Gabi Nakibly, and Dan Boneh. Mobile device identification via sensor fingerprinting, 2014. 11

    2014

  2. [10]

    Private and communication-efficient algo- rithms for entropy estimation, 2023

    Gecia Bravo-Hermsdorff, Róbert Busa-Fekete, Mohammad Ghavamzadeh, An- dres Muñoz Medina, and Umar Syed. Private and communication-efficient algo- rithms for entropy estimation, 2023

    2023

  3. [11]

    Experimental and quasi-experimental designs for research

    Donald T Campbell and Julian C Stanley. Experimental and quasi-experimental designs for research. Ravenio books, 2015

    2015

  4. [12]

    (cross-)browser fingerprinting via os and hardware level features

    Yinzhi Cao, Song Li, and Erik Wijmans. (cross-)browser fingerprinting via os and hardware level features. In Network and Distributed System Security Symposium, 2017

    2017

  5. [13]

    Charge-depleting of the batteries makes smartphones recognizable

    Jing Chen, Yingying Fang, Kun He, and Ruiying Du. Charge-depleting of the batteries makes smartphones recognizable. In 2017 IEEE 23rd International Conference on Parallel and Distributed Systems (ICPADS), pages 33–40, 2017

    2017

  6. [14]

    Do you hear what I hear? fin- gerprinting smart devices through embedded acoustic components

    Anupam Das, Nikita Borisov, and Matthew Caesar. Do you hear what I hear? fin- gerprinting smart devices through embedded acoustic components. InProceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, CCS ’14, New York, NY , USA, 2014. Association...

    2014

  7. [15]

    Exploring ways to mitigate sensor-based smartphone fingerprinting, 2015

    Anupam Das, Nikita Borisov, and Matthew Caesar. Exploring ways to mitigate sensor-based smartphone fingerprinting, 2015

    2015

  8. [16]

    Accelprint: Imperfections of accelerometers make smartphones track- able

    Sanorita Dey, Nirupam Roy, Wenyuan Xu, Romit Roy Choudhury, and Srihari Nelakuditi. Accelprint: Imperfections of accelerometers make smartphones track- able. In NDSS. The Internet Society, 2014

    2014

  9. [17]

    Efraimidis

    Antonios Dimitriadis, George Drosatos, and Pavlos S. Efraimidis. How much does a zero-permission android app know about us? In Proceedings of the Third Central European Cybersecurity Conference, CECC 2019, New York, NY , USA,

    2019

  10. [18]

    How unique is your web browser? In Mikhail J

    Peter Eckersley. How unique is your web browser? In Mikhail J. Atallah and Nicholas J. Hopper, editors, Privacy Enhancing Technologies, pages 1–18, Berlin, Heidelberg, 2010. Springer Berlin Heidelberg

    2010

  11. [19]

    Online tracking: A 1-million-site measurement and analysis

    Steven Englehardt and Arvind Narayanan. Online tracking: A 1-million-site measurement and analysis. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 1388–1401. ACM, 2016

    2016

  12. [20]

    Facebook Research. Faiss. Online at https://github.com/facebookresearch/faiss. Last accessed June 5, 2023

    2023

  13. [21]

    Fp- guard: Detection and prevention of browser fingerprinting

    Amin FaizKhademi, Mohammad Zulkernine, and Komminist Weldemariam. Fp- guard: Detection and prevention of browser fingerprinting. In Pierangela Samarati, editor, Data and Applications Security and Privacy XXIX, 2015

    2015

  14. [22]

    Investigating fingerprinters and fingerprinting-alike behaviour of android applications

    Christof Ferreira Torres and Hugo Jonker. Investigating fingerprinters and fingerprinting-alike behaviour of android applications. In European Symposium on Research in Computer Security, pages 60–80. Springer, 2018

    2018

  15. [23]

    Play Console Help: Example categories

    Google. Play Console Help: Example categories. Online at https://support.google. com/googleplay/android-developer/answer/9859673

  16. [24]

    Play console help: View app statistics

    Google. Play console help: View app statistics. Online at https:// support.google.com/googleplay/android-developer/answer/139628?hl= en&co=GENIE.Platform%3DAndroid

  17. [25]

    Provide information for google play’s data safety section

    Google. Provide information for google play’s data safety section

  18. [26]

    SDK Runtime overview

    Google. SDK Runtime overview

  19. [27]

    Google play sdk index

    Google. Google play sdk index. Online at https://play.google.com/sdks, 2024

    2024

  20. [28]

    Google Research. ScaNN. Online at https://github.com/google-research/google- research/tree/master/scann. Last accessed June 5, 2023

    2023

  21. [29]

    Bamberger, and Serge Egel- man

    Catherine Han, Irwin Reyes, Álvaro Feal, Joel Reardon, Primal Wijesekera, Narseo Vallina-Rodriguez, Amit Elazar, Kenneth A. Bamberger, and Serge Egel- man. The price is (not) right: Comparing privacy in free and paid apps. Proceed- ings on Privacy Enhancing Technologies, 2020(3), 2020

    2020

  22. [30]

    Identify and inspect libraries in android applications

    Hongmu Han, Ruixuan Li, and Junwei Tang. Identify and inspect libraries in android applications. Wirel. Pers. Commun., 103(1):491–503, nov 2018

    2018

  23. [31]

    Towards detecting device finger- printing on ios with api function hooking

    Kris Heid, Vincent Andrae, and Jens Heider. Towards detecting device finger- printing on ios with api function hooking. EICC ’23, New York, NY , USA, 2023. Association for Computing Machinery

    2023

  24. [32]

    Thomas Hupperich, Davide Maiorca, Marc Kührer, Thorsten Holz, and Giorgio Giacinto. On the robustness of mobile device fingerprinting: Can mobile users escape modern web-tracking mechanisms? In Proceedings of the 31st Annual Computer Security Applications Conference, ACSAC ’15, 2015

    2015

  25. [33]

    Formal analysis of the api proxy problem, 2023

    Somesh Jha, Mihai Christodorescu, and Anh Pham. Formal analysis of the api proxy problem, 2023

    2023

  26. [34]

    Kohno, A

    T. Kohno, A. Broido, and K.C. Claffy. Remote physical device fingerprinting. IEEE Transactions on Dependable and Secure Computing, 2(2):93–108, 2005

    2005

  27. [35]

    Are iPhones Really Better for Privacy? A Comparative Study of iOS and Android Apps

    Konrad Kollnig, Anastasia Shuba, Reuben Binns, Max Van Kleek, and Nigel Shadbolt. Are iPhones Really Better for Privacy? A Comparative Study of iOS and Android Apps. 2022(2):6–24

    2022

  28. [36]

    Cross-app tracking via nearby bluetooth low energy devices

    Aleksandra Korolova and Vinod Sharma. Cross-app tracking via nearby bluetooth low energy devices. In Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy, CODASPY ’18, page 43–52, New York, NY , USA, 2018. Association for Computing Machinery

    2018

  29. [37]

    Fingerprinting mobile devices using personalized configurations

    Andreas Kurtz, Hugo Gascon, Tobias Becker, Konrad Rieck, and Felix C Freiling. Fingerprinting mobile devices using personalized configurations. Proc. Priv. Enhancing Technol., 2016(1):4–19, 2016

    2016

  30. [38]

    Libd: Scalable and precise third-party library detection in android markets

    Menghao Li, Wei Wang, Pei Wang, Shuai Wang, Dinghao Wu, Jian Liu, Rui Xue, and Wei Huo. Libd: Scalable and precise third-party library detection in android markets. In 2017 IEEE/ACM 39th International Conference on Software Engineering (ICSE), pages 335–346, 2017

    2017

  31. [39]

    Fpflow: Detect and prevent browser fingerprinting with dynamic taint analysis

    Tianyi Li, Xiaofeng Zheng, Kaiwen Shen, and Xinhui Han. Fpflow: Detect and prevent browser fingerprinting with dynamic taint analysis. In Wei Lu, Yuqing Zhang, Weiping Wen, Hanbing Yan, and Chao Li, editors,Cyber Security, pages 51–67, Singapore, 2022. Springer Nature Singapore

    2022

  32. [40]

    Finding the stars in the fireworks: Deep un- derstanding of motion sensor fingerprint

    Xiang-Yang Li, Huiqi Liu, Lan Zhang, Zhenan Wu, Yaochen Xie, Ge Chen, Chunxiao Wan, and Zhongwei Liang. Finding the stars in the fireworks: Deep un- derstanding of motion sensor fingerprint. IEEE/ACM Transactions on Networking, 27(5):1945–1958, 2019

    1945

  33. [41]

    Libradar: Fast and accurate detection of third-party libraries in android apps

    Ziang Ma, Haoyu Wang, Yao Guo, and Xiangqun Chen. Libradar: Fast and accurate detection of third-party libraries in android apps. In Proceedings of the 38th International Conference on Software Engineering Companion, ICSE ’16, page 653–656, New York, NY , USA, 2016. Associatio...

    2016

  34. [42]

    René Mayrhofer, Jeffrey Vander Stoep, Chad Brubaker, Dianne Hackborn, Bram Bonné, Güliz Seray Tuncay, Roger Piqueras Jover, and Michael A. Specter. The android platform security model (2023), 2021

    2023

  35. [43]

    Microsoft. SPTAG. Online at https://github.com/microsoft/SPTAG. Last accessed June 5, 2023

    2023

  36. [44]

    Hardware fingerprinting using html5, 2015

    Gabi Nakibly, Gilad Shelef, and Shiran Yudilevich. Hardware fingerprinting using html5, 2015

    2015

  37. [45]

    Privaricator: Deceiving fingerprinters with little white lies

    Nick Nikiforakis, Wouter Joosen, and Benjamin Livshits. Privaricator: Deceiving fingerprinters with little white lies. In Proceedings of the 24th International Conference on World Wide Web, WWW ’15, 2015

    2015

  38. [46]

    Cookieless Monster: Exploring the Ecosys- tem of Web-Based Device Fingerprinting

    Nick Nikiforakis, Alexandros Kapravelos, Wouter Joosen, Christopher Kruegel, Frank Piessens, and Giovanni Vigna. Cookieless Monster: Exploring the Ecosys- tem of Web-Based Device Fingerprinting. In 2013 IEEE Symposium on Security and Privacy, pages 541–555, May 2013

    2013

  39. [47]

    The leak- ing battery

    Łukasz Olejnik, Gunes Acar, Claude Castelluccia, and Claudia Diaz. The leak- ing battery. In Joaquin Garcia-Alfaro, Guillermo Navarro-Arribas, Alessandro Aldini, Fabio Martinelli, and Neeraj Suri, editors, Data Privacy Management, and Security Assurance , pages 254–263, Cham, ...

    2016

  40. [48]

    Androprint: Analysing the fingerprintability of the android api

    Gerald Palfinger and Bernd Prünster. Androprint: Analysing the fingerprintability of the android api. In Proceedings of the 15th International Conference on Availability, Reliability and Security , ARES ’20, New York, NY , USA, 2020. Association for Computing Machinery

    2020

  41. [49]

    On the security and applicability of fragile camera fingerprints

    Erwin Quiring, Matthias Kirchner, and Konrad Rieck. On the security and applicability of fragile camera fingerprints. In Computer Security – ESORICS 2019: 24th European Symposium on Research in Computer Security, Luxembourg, September 23–27, 2019, Proceedings, Part I, page 450...

    2019

  42. [50]

    Dubois, Ashwin Rao, David R

    Jingjing Ren, Martina Lindorfer, Daniel J. Dubois, Ashwin Rao, David R. Choffnes, and Narseo Vallina-Rodriguez. Bug fixes, improvements, ... and privacy leaks - a longitudinal study of pii leaks across android app versions. In Network and Distributed System Security Symposium, 2018

    2018

  43. [51]

    Clock around the clock: Time-based device fingerprinting

    Iskander Sanchez-Rola, Igor Santos, and Davide Balzarotti. Clock around the clock: Time-based device fingerprinting. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS ’18, page 1502–1514, New York, NY , USA, 2018. Association for Com...

    2018

  44. [52]

    Prochar- vester: Fully automated analysis of procfs side-channel leaks on android

    Raphael Spreitzer, Felix Kirchengast, Daniel Gruss, and Stefan Mangard. Prochar- vester: Fully automated analysis of procfs side-channel leaks on android. In Proceedings of the 2018 on Asia Conference on Computer and Communications Security, ASIACCS ’18, 2018

    2018

  45. [53]

    Starov and N

    O. Starov and N. Nikiforakis. Xhound: Quantifying the fingerprintability of browser extensions. In 2017 IEEE Symposium on Security and Privacy (SP) , pages 941–956, Los Alamitos, CA, USA, may 2017. IEEE Computer Society

    2017

  46. [54]

    Mobile device fingerprint identification using gyroscope resonance

    Junze Tian, Jianyi Zhang, Xiuying Li, Changchun Zhou, Ruilong Wu, Yuchen Wang, and Shengyuan Huang. Mobile device fingerprint identification using gyroscope resonance. IEEE Access, 9:160855–160867, 2021

    2021

  47. [55]

    Güliz Seray Tuncay, Jingyu Qian, and Carl A. Gunter. See no evil: Phishing for permissions with false transparency. In 29th USENIX Security Symposium (USENIX Security 20), pages 415–432. USENIX Association, August 2020

    2020

  48. [56]

    Visualizing data using t-sne

    Laurens van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of Machine Learning Research, 9(86):2579–2605, 2008

    2008

  49. [57]

    Accelerometer-based device fingerprinting for multi-factor mobile authentication

    Tom Van Goethem, Wout Scheepers, Davy Preuveneers, and Wouter Joosen. Accelerometer-based device fingerprinting for multi-factor mobile authentication. In Juan Caballero, Eric Bodden, and Elias Athanasopoulos, editors, Engineering Secure Software and Systems, Cham, 2016

    2016

  50. [58]

    Orlis: Obfuscation- resilient library detection for android

    Yan Wang, Haowei Wu, Hailong Zhang, and Atanas Rountev. Orlis: Obfuscation- resilient library detection for android. In 2018 IEEE/ACM 5th International Conference on Mobile Software Engineering and Systems (MOBILESoft), 2018

    2018

  51. [59]

    How to use t-sne effec- tively

    Martin Wattenberg, Fernanda Viégas, and Ian Johnson. How to use t-sne effec- tively. Distill, 2016

    2016

  52. [60]

    Efficient fingerprinting-based android device identification with zero-permission identifiers

    Wenjia Wu, Jianan Wu, Yanhao Wang, Zhen Ling, and Ming Yang. Efficient fingerprinting-based android device identification with zero-permission identifiers. IEEE Access, 4:8073–8083, 2016

    2016

  53. [61]

    Libroad: Rapid, online, and accurate detection of tpls on android

    Jian Xu and Qianting Yuan. Libroad: Rapid, online, and accurate detection of tpls on android. IEEE Transactions on Mobile Computing, 21(1):167–180, 2022

    2022

  54. [62]

    Yahoo! JAPAN. NGT. Online at https://github.com/yahoojapan/NGT. Last accessed June 5, 2023

    2023

  55. [63]

    Yandex. Hnswlib. Online at https://github.com/nmslib/hnswlib. Last accessed June 5, 2023. 12

    2023

  56. [64]

    Atvhunter: Reliable version detection of third-party libraries for vul- nerability identification in android applications

    Xian Zhan, Lingling Fan, Sen Chen, Feng Wu, Tianming Liu, Xiapu Luo, and Yang Liu. Atvhunter: Reliable version detection of third-party libraries for vul- nerability identification in android applications. In Proceedings of the 43rd International Conference on Software Enginee...

    2021

  57. [65]

    Xian Zhan, Lingling Fan, Tianming Liu, Sen Chen, Li Li, Haoyu Wang, Yifei Xu, Xiapu Luo, and Yang Liu. Automated third-party library detection for android applications: Are we there yet? In 2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE), pa...

    2020

  58. [66]

    Research on third-party libraries in android apps: A taxonomy and systematic literature review

    Xian Zhan, Tianming Liu, Lingling Fan, Li Li, Sen Chen, Xiapu Luo, and Yang Liu. Research on third-party libraries in android apps: A taxonomy and systematic literature review. IEEE Transactions on Software Engineering, 48(10):4181–4213, 2022

    2022

  59. [67]

    A systematic assessment on android third-party library detection tools

    Xian Zhan, Tianming Liu, Yepang Liu, Yang Liu, Li Li, Haoyu Wang, and Xiapu Luo. A systematic assessment on android third-party library detection tools. IEEE Transactions on Software Engineering, 48(11):4249–4273, 2022

    2022

  60. [68]

    Beresford, and Ian Sheret

    Jiexin Zhang, Alastair R. Beresford, and Ian Sheret. Sensorid: Sensor calibration fingerprinting for smartphones. In 2019 IEEE Symposium on Security and Privacy (SP), pages 638–655, 2019

    2019

  61. [69]

    Beresford, and Ian Sheret

    Jiexin Zhang, Alastair R. Beresford, and Ian Sheret. Factory calibration finger- printing of sensors. IEEE Transactions on Information Forensics and Security, 16:1626–1639, 2021

    2021

  62. [70]

    Art and Design

    Zhe Zhou, Wenrui Diao, Xiangyu Liu, and Kehuan Zhang. Acoustic fingerprinting revisited: Generate stable device id stealthily with inaudible sound. InProceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, CCS ’14, page 429–440. Association for C...

    2014

  63. [2019]

    Association for Computing Machinery

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.