Hacker News Reader

Comment by dutchbrit | Hacker News Reader

Whatsapp use to use IMEI reversed and md5 hashed as its password on Android (username was the users telephone number) - on iPhone they used a MAC address. I brought it up as a security concern back in 2012.

It would not surprise me if some apps still use IMEI (or MAC address) for similar purposes…

View on HN

Third party Android apps cannot read the IMEI number. Source:

https://developer.android.com/about/versions/10/privacy/chan...

Since Android 10, released in 2019.

… which means that apps that are working on any kind of modern device can't rely on this behaviour, and thus can't generate passwords or other account critical secrets using this method. Apps written for modern Android phones can't use the IMEI for any legitimate purposes anymore, unless the device is rooted or the IMEI is exposed in some other unofficial way.

https://www.androidpolice.com/googles-latest-android-version... hints that ~49% of Android devices will give out the IMEI to third-party apps. [late 2021]

That's still a majority of devices where you can't assume that the IMEI is available. I'd argue processing the IMEI for legitimate purposes (i.e. generating device passwords) is not something you should rely on and instead you should come up with a solution that works in both cases.

It still works fine if your intent is to stalk users, though.

> That's still a majority of devices where you can't assume that the IMEI is available.

51%. Super strong argument there.¨

If an app can't use a certain logic for half of its install base, and needs a separate flow anyways, why would it bother with having two?

Third party android apps used to be able too 100%, it's a very callable action.

TelephonyManager tm = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);

Neither can iOS apps see identifiers like MAC addresses.

Glad to read that they removed this in iOS 11

Reply on news.ycombinator.com