Posts

Post not yet marked as solved
1 Replies
260 Views
According to documentation, the guideline is as follows - "Don’t reuse a key among multiple users on a device because this weakens security protections. In particular, it becomes hard to detect an attack that uses a single compromised device to serve multiple remote users running a compromised version of your app." This can be addressed if we keep a tally of how many users have used the same key pair? If we see a single key pair in use across say 500 users, it's clearly an instance of compromised device. Are there other security reasons why binding a key to device + user is the recommended practice?
Posted Last updated
.