Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite
1

I'm currently in the phase of planing a project involving loginless service.

Users would be identified by an unique device id created on the client (ios).

What are the security concerns?

  • sockets would be wrapped with ssl
  • create a private certificate to verify client? (what about someone decompiling the binary and obtaining it?)

any thoughts are appreciated

share|improve this question
1  
Please don't cross-post. – Bruno Jul 25 '12 at 19:21
Bruno, should i delete the question on one site? – sebastianmarkow Jul 25 '12 at 19:23
1  
Similar question security.stackexchange.com/q/10268/6249 – logicalscope Jul 25 '12 at 19:49
You can make SSL to validate the website, and random crypted token for authenticating the user, which is encrypted on the server, like sessionid, and stored on the phone. But when your iphone is erased, the local storage is too, so the user would have to re-authenticate, but as long it has the server-side encrypted token, this is OK. I do it and it's OK, I know how many iPhones I serve. I dont identify by Apple Unique ID or anything else and I would never rely on this, as iPhones dont like to be authenticated this way. – Andrew Smith Jul 25 '12 at 20:33
@AndrewSmith so you generate a crypted device token on first connection? How do you re-authenticate if it's not bound to a device specific id? just curious... – sebastianmarkow Jul 25 '12 at 20:55
show 1 more comment

1 Answer

up vote 1 down vote

If you can store a device ID on the client, then you can use that as both "username" and "password": within the SSL tunnel, the client sends the device ID, which the server looks up in the database. If the device ID is found, voilà! the client is authenticated. Remember that "a client is authenticated" has the same meaning as "no other entity than the client himself could have said that". As long as the "device ID" is client-specific, secret, and unguessable, it is a proper basis for authentication.

Of course, a customer who extracts the data contents of his device and reverse engineers the code will find his own device ID, and will be able to access the server from other computers. That's unavoidable. You cannot enforce usage of a specific client device unless the client device contains a tamper-resistant element (e.g. a TPM), and, apparently, iPhones do not. Certificates or other cryptographic gizmos won't help you there.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.