Android and iOS

Device identity and fingerprinting limitations

Code tampering, account abuse, data exposure and client manipulation.

Threats and abuse1 min readEditorial methods

Mobile identifiers can reset, change or match incorrectly. Design enrollment, change and recovery lifecycles instead of assuming permanent, error-free device recognition.

Evaluation approach

Assess application-scoped identifiers alongside reinstallation and device replacement. Account for platform restrictions and data requirements.

Application example

Do not treat two people sharing a tablet as one person solely because their device identifier matches.

Limits and considerations

A fingerprint is neither immutable nor infallible. An attacker or a normal update can change the environment.

Question assumptions of permanent identity

An identifier may behave differently after reinstallation, reset or ownership transfer. Several people can also share one phone. Equating a device with a person can lead to incorrect sanctions.

Define enrollment and revocation explicitly. Evidence for a new device does not automatically inherit an old account's authority. Prefer an identifier and access model limited to the business purpose over unnecessary permanent tracking.

Checks and decisions

  • State the identifier's purpose
  • Limit retention
  • Measure matching errors

Use device relationships for risk analysis rather than definitive conclusions about a person.

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.