fingerprintjs / fingerprintjs-android

Swiss army knife for identifying and fingerprinting Android devices. MIT license, no restrictions on usage in production.
https://fingerprint.com/github/
MIT License
572 stars 83 forks source link

[Question]How do I know, how many device will get duplicate fingerprint when using stable mode? #36

Closed kenneth2008 closed 3 years ago

kenneth2008 commented 3 years ago

[Question]How do I know, how many device will get duplicate fingerprint when using stable mode?

For example, I am using this for identify 10,0000 device if they have gain gift before.

How many device will be duplicated?

Will every phone got the same fingerprint in the same model and the same production batch?

Alexey-Verkhovsky commented 3 years ago

Hello!

STABLE fingerprint is calculated using stable hardware signals, and it's not changing after a factory reset. You also should keep in mind that this means that a lot of devices (with the same hardware) will have the same ID. You can consider this STABLE fingerprint as a hardware ID.

Answering the question, there will be as many duplicates as many devices with identical hardware. For example, every Samsung Galaxy S20 with 256 GB storage and Qualcomm processor will have the same STABLE fingerprint.

To solve your issue I recommend you to use all three deviceIds, which are: GSF ID, Media DRM ID, and Android ID.

Every ID uniquely corresponds to a device instance. They are not changing when the system is updating or applications changing. GSF ID and Android ID can be spoofed on a rooted device. Media DRM ID is harder to spoof, but not every device has it.

So the following ID will solve your problem with gift fraud:


val fingerprinter = FingerprinterFactory
        .getInstance(applicationContext, Configuration(version = 3))

fingerprinter.getDeviceId { result ->
  val deviceId = result.mediaDrmId ?: result.gsfId ?: result.androidId // Use this ID
}

The IDs will change after a factory reset. But, it's important to know, that every device can be resold, and a different user can use the device with legal interest. So trying to create an ID that survives after a factory reset is a wrong way for identification.

Hope it helps!

kenneth2008 commented 3 years ago

It helps.