Mobile identifiers can reset, change or match incorrectly. Design enrollment, change and recovery lifecycles instead of assuming permanent, error-free device recognition.
Evaluation approach
Assess application-scoped identifiers alongside reinstallation and device replacement. Account for platform restrictions and data requirements.
Application example
Do not treat two people sharing a tablet as one person solely because their device identifier matches.
Limits and considerations
A fingerprint is neither immutable nor infallible. An attacker or a normal update can change the environment.
Question assumptions of permanent identity
An identifier may behave differently after reinstallation, reset or ownership transfer. Several people can also share one phone. Equating a device with a person can lead to incorrect sanctions.
Define enrollment and revocation explicitly. Evidence for a new device does not automatically inherit an old account's authority. Prefer an identifier and access model limited to the business purpose over unnecessary permanent tracking.
Checks and decisions
- State the identifier's purpose
- Limit retention
- Measure matching errors
Use device relationships for risk analysis rather than definitive conclusions about a person.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.