2

I'm currently developing an Android (and probably iOS in the future) application for my company.

I was wondering what is the most unique data identifier to authenticate the users. A data that cannot be repeated through users. For example:

  • Email? That user can log in with another phone using the email and password

  • Phone number? Could be the most unique one but it would required to verify the phone and I will have to setup a SMS validation service like WhatsApp

  • IMEI? It pretty much validates the unique phone but it can be spoofed or replaced. Although I don't know if the application required permissions for this.

  • Maybe a mix of all this methods?

My main goal is to save this data as a database and make it the primary key of it and with this know exactly who's the user that it's really using the company web services.

  • Spoofing the IMEI is not that easy. And it requires READ_PHONE_STATE permissions anyways – usr-local-ΕΨΗΕΛΩΝ Jan 20 at 13:00
3

It sounds like you've got two problems that you're kinda rolling into one:

  1. Device enrollment -- you need some way to know which user to register this device to, that's where the email or the phone number comes in. A valid user can register any device they want, as long as you can track the device somehow.
  2. Fingerprint the device -- on subsequent logins, know whether it's the same device or a different device.

If you find the right google terms, I'm sure this is a problem that's been solved many times before.

I would assume that most solutions involve planting some kind of unique secret on the device during the enrollment step that can be checked at subsequent logins, like an API key or a client certificate.

| improve this answer | |
  • 2
    Hey. Thanks a lot for your reply. I think this method is better. Making the user save a public key will make the device enrolled completely as long as they do not hard reset it. Thank you. – NathanWay Jan 17 at 0:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.