3

I have a hypothetical mobile game where players don't necessarily need to create accounts to play. Their data is keyed off of a device identifier like an advertising identifier (IDFA) or Apple's identifierForVendor or Android ID

For GDPR, I need to allow all users to download their data.

Is it safe to use the ID as an authentication secret to uniquely identify a user/device, or are these ID values predictable / published somewhere and easy to spoof?

1

You could salt and hash the identifier, and store the result on your database. When the user wants his data, you hash and salt the ID, do a lookup on your tables and recovery the data. Guessing the ID from a properly salted hash is near impossible.

On Android phones, you can change the Android ID on rooted phones. I don't know if this is possible on Apple phones.

  • The way I'm reading the question is: "Is it safe to use the ID as an authentication secret to uniquely identify a user/device, or are these ID values published somewhere and easy to spoof?" – Mike Ounsworth Sep 13 '18 at 18:34
  • I agree with @MikeOunsworth, there needs to be more examination of whether these identifiers are secret and unpredictable. I didn't see anything useful in the Apple documentation, and while android_id used to be 64 random bits, I see no mention of how it's generated in android 9. – AndrolGenhald Sep 13 '18 at 19:04
  • @MikeOunsworth and @AndrolGenhald that interpretation is exactly correct--and better phrased. Apple's identifierForVendor seems like it's not published. It's also a UUID so, depending on implementation, it might be unguessable... – Shruggie Sep 13 '18 at 23:20
  • 1
    @ben Yeah, I'm always wary with UUIDs -- they were designed to be unique, but there's absolutely nothing in their spec about being unguessable. "it might be unguessable, depending on implementation" is about right. – Mike Ounsworth Sep 13 '18 at 23:22
1

If you can get the device ID, so can any malicious app

Think about it this way: would you want every other app on the player's phone to have the ability to send data to a centralized hub where they could then make fake web requests to your game on behalf of this user?

Now, sure, most of the apps on the user's phone aren't doing this, but do you really want to open that door?

If you want passwordless authentication and good security, you are probably better off going with a standard solution (Authy, maybe Authentiq, etc.).

  • The reason I put maybe in front of Authentiq is that I just stumbled across them on the internet and haven't really heard a trusted source say they are secure yet. However, it looks fairly promising... maybe some of the others can chime in if they have experience with it. – NH. Oct 18 '18 at 23:51
  • 1
    Good point. That throws all device IDs out the window. In the case with Apple devices, identifierForVendor may solve this particular problem. FWIW, I'm evaluating whether it's possible to "bolt on" a solution to a set of existing games that don't have authentication methods. – Shruggie Oct 20 '18 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.