Are you sure the app wasn't internally using the UUID of the device as the second token? This[1] shows an analysis of the efficacy on Android 5.x even with root

Are you sure the app wasn't internally using the UUID of the device as the second token? This[1] shows an analysis of the efficacy on Android 5.x even with rooted phones/malicious end-users. 99.5% isn't as good as an RSA SecurID but it's not too shabby. I'd imagine iOS has something similar too. If not, good catch, that's a glaring issue and a great attack vector as you could likely script away emulating the traffic of the device, and you've got a decent chance that since they're using a different authentication method, maybe rate limiting wouldn't be factored in as well. Out of curiosity, what else do you audit? [1] http://stackoverflow.com/questions/2785485/is-there-a-unique-android-device-id/5626208#5626208 http://stackoverflow.com/questions/2785485/is-there-a-unique...