4

I'm currently creating a mobile app and have the following issue. I am required to only allow the user to login from a device that is registered to the users account. A user can have up to X number of devices registered at any one time.

So when the user registers and they first sign-in. I would need to register the device. Then on each request to the backend webapi, the webapi would need to verify the request came from the registered device.

How would you identify the device? Would you generate some kind of secret locally on the device and share it with the webapi?

Any ideas on how to architect this?

I'm planning to use dotnet core with identity framework for the backend and either xamarin or flutter for the front.

Improve this question
4
  • this is a hard requirement if you want it exactly as specified. ie the device rather than the installation or user
    – Ewan
    Commented Jun 12, 2019 at 9:36
  • I understand, I'm thinking how banking apps will only let you login from registered devices or netflix only let you watch from registered devices. So I'm wondering how do they lock down their services down to device level
    – Ankeet Dhanji
    Commented Jun 12, 2019 at 9:38
  • i recon they lock to an installation rather than device. you can access various device Ids, generate an id on first run or try and profile the device
    – Ewan
    Commented Jun 12, 2019 at 10:41
  • 1
    @AnkeetDhanji Most banking apps lock you not the device but to a given android or IOS installation. On Brazil, often you have to bring your device to an ATM and have it authenticate it via a number it shows you on-screen. It is a very convoluted and unfriendly process.
    – T. Sar
    Commented Jun 12, 2019 at 12:10

1 Answer 1

Reset to default
3

Is there a unique android ID question gives a good overview of the options to get a unique id for android. Best practices for Unique Identifiers recommends using instanceID for most use cases. See IdentifierForVendor for iOS products. Once you have an ID, hash it and send the hash to the webapi over a secure connection. This does not protect against rooted devices.

To handle rooted devices would require a hardware backed keystore where you generate a private/public keypair where the private key is stored in a separate chip that cannot be read, even by the OS. Here the webapi should generate some random data, send it to the device where it is encrypted by the private key and send it back. Use public key for decryption and check that the data is the same.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.