Glossary
Device Binding
Device binding ties a credential or an active session to a specific device, using something about that device that's hard to reproduce elsewhere, so the credential functions correctly only on the original device it was issued to. A credential that isn't bound this way works identically no matter where it's presented from; a bound one fails, or triggers additional scrutiny, the moment it's presented from an unrecognized device.
This substantially narrows what a stolen credential is actually worth to an attacker: intercepting or copying the credential's value alone isn't sufficient if using it also requires reproducing whatever device-specific property it was bound to, which is precisely why device binding is common in contexts — banking apps prominent among them — where the cost of a stolen credential being fully usable elsewhere is judged to be too high to accept.