I have a web application that allows users to add mobile devices to their accounts (using mobile app).
Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so it uses
device.uuid variable for this purpose. An app written in PhoneGap can be run on many systems, but my application targets Android and iOS only.
The question: How my system (both server and mobile client) should react, when it detect, that new user account (new login and pass) is trying to add a device, which UUID already exists in a database and is currently bound to another user account?
Can I assume (in today's world — on iOS and Android) that the UUID of any particular device:
- is unique without any doubts (two devices can't have the same UUID),
- is secure (can't be changed or spoofed).
In other words: Can my service automatically "rebind" particular device (UUID) to another user account, in situation described above? Can I assume that there are no two devices with the same UUID and there are no too easy ways on spoofing UUID?
Or should I introduce some "more secure" logic in such situations? Like some kind of device deregister (from first account) and re-register (on new account)? And dissallow user (user account) to add / register new device, if the same UUID is already registered with another user account?
I won't deny, I'm a layman in security subject. So, I would assume, that UUIDs are unique and spoofing-resistant enough to introduce mentioned automatic device (UUID) re-registration in mentioned situation.