This question is related to this one.
We're busy implementing 5 digit passcode authentication for our app (Android, iPhone), but we're running into a complexity. We're unsure how we can safely identify the device from which the app makes the request. We can send and register the device id (UUID) with the user, but that id is no secret, so anyone knowing that UUID could try to authenticate with the server using the passcode.
The answer in the related question mentions this: "During device registration, the application on the device (be it a phone or a laptop) generates some secret value and sends it to the bank; it also stores it."
That sounds reasonable, but how do we store that secret value on the phone? We could use Local Storage, but how secure is that? Is that sufficient?
Another way would be to set a (persistent) cookie upon registering the passcode. But I'm not sure how safe that is either.
I see this system implemented in many apps, but there's not much information to be found on the web.