0

We want to let users register on our Mobile App with their Phone Number, then verify it using SMS without the need to enter a password -- may be like what WhatsApp is doing with their on-boarding process:

enter image description here

We want the registration scenario to be user-friendly & to help us giving a secure authentication later on, which is really hard without having a password, so user identity will be his number & his verified Mobile Device (& also we may consider the SIM ID for security purposes)

We tried to list the different combinations about how to be sure of user identity between these factors:

  • Phone Number (old/new)
  • Device Id (old/new)
  • SIM Id (old/new)

and we were overwhelmed with the large number of scenarios that we should handle, like for example, if a registered user (old number) bought a new mobile (new Device Id) & wants to open our app there!

.. So, What is the best simple scenario for Mobile-App registrations using phone number?

  • Can you please clarify what you mean by "old/new" ? Do you already have data about the users while they are going through the registration process ? Also, what is the Device ID and the SIM ID in this case ? – Pierre Jul 8 '14 at 21:44
  • well, I'll try to clarify this in the question, but for now, the user may change his phone, & he should keep his data, so in this case he has a new Device Id that should be verified & so on – AbdelHady Jul 9 '14 at 9:32
  • 1
    Users can actually change their phones (i.e. the terminal) and/or independently change their phone number. It looks like you need to have an unambiguous conduit to each user. A personal email address seems to be the standard adopted by many app providers for this purpose and it does not require any additional password. – Pierre Jul 9 '14 at 10:31
1

The only scenario in which you could avoid a separate authentication mechanism (for example a password) is when the user has both devices or SIM cards at hand.

I assume sim card id is equal to phone number to keep it easy, you should have no problem to extend the examples.

  • User has neither the old sim card nor the old phone. (For example after a year at a foreign country.) There is no way this user could authenticate himself without additional account settings.
  • User has only the old sim card. (Old phone is broken or lost.) This is easy if only a phone number match is mandatory, else it's not possible to get the old device id.
  • User has only the old phone. (Changed mobile provider.) If the user is still logged in, he might request a phone number change within your app. But you cannot require a verification by the old phone number. If the login expired, because the new mobile provider needed several weeks to setup, then the account is lost.
  • User has both the old sim card and the old phone. If the user has multiple sim cards and mobile phones this is easy. If the user has only one mobile or SIM card, it requires multiple restarts and SIM card swaps.

If losing an account isn't a problem (the WhatsApp way), you could stick to the phone number or maybe even to a combination with the device id. But if you need durable accounts, you should introduce a separate authentication mechanism.

You need at least a password associated with the old phone number to create a recoverable user login. On manual login you could force your user to update their sim card id / device id / phone number immediately before resuming services.

0

If the user changes his/her phone, and want to continue its service, in such situation, system should validate the phone number by sending a confirmation message to the user. And once the user is validated against the new Device id and Sim ID then update these information in the system, so that previous app in the old device will become inactive.

0

My recommendation, if this is possible for you, is to include a user name or use their email address as a user name. Let's look at what this gets you if you do this.

1) If they get a new phone and maintain their old phone number, you can simply send them a text, have them respond in whatever way you want to prove it's them, and they're in.

2) If the get a new phone and a new number, they need only have their user name and specify that they have a new number. You send a text to the new number, they respond, and now their account is associated with the new number.

3) If they have an old phone with a new number, the process should be the same as #2.

People are used to user names and it's not a bad construct. It gives you a way to associate user information with something that's certain not to change.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.