Limit the number of different devices an account can login from.

[joseEkcit]

Limit the number of different devices an account can login from

Problem

Reference: forum post

When 2FA is not an option, users can share their account credentials with anyone else. This is a real problem for any subscription model.

It's the same issue Netflix is facing: link to external post.

Solution

The ideal solution would be FA being able to handle this. I imagine it would store the device fingerprint (f.e. using fingerprint.js) in the user data / registration data, and then check the count against a limit set in the tenant/application settings on every login.

Another solution would be allowing Lambdas to import external js libraries, or even make API calls within them would do the trick.

Alternatives/workarounds

If you can technically afford 2FA, as well as in terms of UX and data compliance, that could be an option for you.

Another solution would be implementing a WAF, for example the AWS WAF, and manage this behaviour using rules. Although it is another extra layer on top of the solution.

Additional context

fingerprint.js: link

Related

• Limit a user to a single session #1363
• prevent concurrent sessions from two different devices #2421

How to vote

Please give us a thumbs up or thumbs down as a reaction to help us prioritize this feature. Feel free to comment if you have a particular need or comment on how this feature should work.