Exploitation and mitigation of authentication schemes based on device-public information