Reading your post hit me like a ton of bricks . We ' ll get through this man . <| sep |> WHAT ABOUT DHB BASE BASE <| sep |> 5 of 6 get up from the floor open the doorOH SHIT , EVRYBUDY BOUDA BE WALKIN A DINASAROh , nope . 6 of 6 he gets on the floorOH SHIT THEY BOUDA DO ITOh , nope again . insert endingNot bad . <| sep |> I really like the music in the Ruins , it makes the whole thing seem that much more important . <| sep |> The app should be able to detect whether or not its running inside an emulator and refuse to process the request there are many apps which refuse to run inside an emulator , its pretty easy to figure out . And yes , you ' re right , it could copy the session cookie which is why the app should only allow short sessions . Also , getting the MAC address isn ' t allowed as of Android Marshmallow . Either using the singleuse token , or removing the permission to read MS , would alert the user to an irregularity , which you wouldn ' t want to do . That ' s a bad idea . The token on the vehicle would just be for initial device registration , similar to how you tether bluetooth devices toether . A physical OTP is the most secure solution , but it ' s far from the only secure solution . SMS is pretty damn secure if you ' re using OTP , because it alerts the user and provider to an issue . Tesla ' s servers could even go so far as to alert the user if the same OTP is used in rapid succession , and possibly lock out certain functions until the user verifies the action was intentional .