iOS attestation token rotation at scale: How are you handling per-account distinctness?

flatshower said:

Running an iOS-authenticated setup: coherent device profiles (model, OS, build, and screen metrics all internally consistent), a dedicated pool of rotating mobile proxies with per-account stickiness/pooling, and behavioral modeling plus ML-driven reverse engineering on the automation side. That layer is stable and coherent end to end.

The biggest painpoint at scale is DCAppAttest. Key generation is Secure Enclave bound, so attestation minting is gated on genuine Apple hardware. A single device can loop generateKey for distinct keyIds, but every one of them still traces back to one physical Enclave. At the JWT layer they look independent. So the real question is not whether I can make distinct tokens. It is whether they are distinct at the layer the target actually inspects, and whether the target checks that deep at all.

Sharing one token fleet-wide is a trivial correlation kill, since a single jti across many distinct device IDs falls out of a basic grouping. Genuine per-account distinctness seems to require accepting that one-device multi-key only holds as long as the target is not doing receipt-level validation.

So how is everyone actually handling this at scale? Options I can see: multi-key off a small mint fleet with header-layer fingerprint variance on top, a rotation pool sized to persona count, or a dedicated minting service. The more important question: is anyone seeing evidence the target does receipt-level device-count validation, or is it shallow JWT signature checking in practice?

Click to expand...