Are you sure the app wasn&#x27;t internally using the UUID of the device as the second token? This[1] shows an analysis of the efficacy on Android 5.x even with rooted phones&#x2F;malicious end-users. 99.5% isn&#x27;t as good as an RSA SecurID but it&#x27;s not too shabby. I&#x27;d imagine iOS has something similar too.<p>If not, good catch, that&#x27;s a glaring issue and a great attack vector as you could likely script away emulating the traffic of the device, and you&#x27;ve got a decent chance that since they&#x27;re using a different authentication method, maybe rate limiting wouldn&#x27;t be factored in as well.<p>Out of curiosity, what else do you audit?<p>[1] <a href="http:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;2785485&#x2F;is-there-a-unique-android-device-id&#x2F;5626208#5626208" rel="nofollow">http:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;2785485&#x2F;is-there-a-unique...</a>