Device binding links accounts to specific registrations. It is distinct from collecting hardware identifiers; key-based registration may be suitable.
Evaluation approach
Define key generation, account binding and removal. Adding a device is a consequential action.
Application example
Verify new registrations strongly and revoke older ones when appropriate. Review data migration separately.
Limits and considerations
A registered device does not make every transaction legitimate.
Handling device transfer
Selling or sharing a phone must not preserve previous-account authority. Let users view and remove registrations, and prevent a new account from silently inheriting an old local record.
Checks and decisions
- Register with keys
- Verify new enrollment
- Revoke old records
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.