Device fingerprinting
Device fingerprinting is the practice of combining hardware and software attributes into an identifier that distinguishes one device from another without an explicit account or cookie.
A mobile fingerprint typically draws on the build fingerprint, screen geometry, installed sensor list and calibration values, GPU vendor and renderer strings, available codecs, locale and timezone, and network characteristics.
For a security tester the fingerprint matters in both directions. It is the mechanism by which an application decides whether to trust the environment, and it is also, when collected without disclosure, a privacy finding in its own right.
Related terms
- Emulator detection — Emulator detection is the set of runtime checks an application performs to determine whether it is running on virtualised hardware rather than a physical handset.
- OWASP MASVS — The OWASP Mobile Application Security Verification Standard is a framework that defines what a mobile application must satisfy to be considered secure, organised into control groups covering storage, cryptography, authentication, network, platform interaction, code quality and resilience.