Private unique device identifier in iOS

Question

We're working on a project with my colleagues which involves using a lot of private and non official code. This is not intended for AppStore use.

The first and only requirement we have is to not use jailbreak.

First of all, UDID or OpenUDID or any other solutions don't work here and they're not expected to.

We've done a lot of background research and tests, starting with trying to get the IMEI, ICCID, IMSI and the Serial Number programatically. None of the above methods work with iOS 7 and above without jailbreak.

We've also spent a couple of months to play with IOKit framework using the famous IOKitBrowser and dumping the whole contents of iOS internals. Unfortunately, we discovered that with iOS 8.3 it stopped working.

We're talking here not about getting the UDID or any other "mainstream" thing, but generally speaking we need a way to get

any permanent hardware identifier unique enough to identify a device that would persist in spite of device wipes and amongst different iOS versions

This question is no duplicate to others (no solutions are found here, for example) and is targeting solely private APIs.

Any help would be highly appreciated.

Answer 1

I don't know if commercial solutions are of interest to you but check out http://www.appsflyer.com

I'm not affiliated with them but we used their SDK at my previous employer. They have a device fingerprint technology which does work.

Note: If the user resets the IDFA then AppsFlyer will see this as a new device. However, and its been awhile so I can't remember, I think you can use their SDK, not use AdSupport.framework, and then they won't have the IDFA available to them. So I'm guessing that their device fingerprinting may work.

They also have competitors, search for device fingerprinting. Check out Yozio and branch.io, they both claim to do this. I've not used their product, just seen their websites.

Answer 2

Are you allowed to ask the user for their MSISDN's? (international phone numbers) Like what whatsApp is doing when you first login with them by confirming with a SMS code sent to the user msisdn. If you know the MSISDN's of your users, you can keep them in your servers DB and only allow a white-listed msisdn to register and use your services. If you want to be more secure you can send the SMS's more often however there is a way to understand SIM-card change (this is for t-mobile and europe use i guess) from within the APP so that the user cant fool you by enetering SMS for a different MSISDN and then change to his/her real MSISDN sim card.

MSISDNs are unique worldwide and they are secured by the telecom operators so i guess this solution is strictly secure. What do you say? good luck

update: actually upon reading your question carefully again, I think you dont want the user to login any info right? if thats the case sorry for the wrong answer:/

note: why cant you use

[[[ASIdentifierManager sharedManager] advertisingIdentifier] UUIDString]

the advertising identifier is unique to the device and permanent i guess. I dont know if you can use it privately though..