Better Registration for Mobile Apps

Question

We want to let users register on our Mobile App with their Phone Number, then verify it using SMS without the need to enter a password -- may be like what WhatsApp is doing with their on-boarding process:

We want the registration scenario to be user-friendly & to help us giving a secure authentication later on, which is really hard without having a password, so user identity will be his number & his verified Mobile Device (& also we may consider the SIM ID for security purposes)

We tried to list the different combinations about how to be sure of user identity between these factors:

• Phone Number (old/new)
• Device Id (old/new)
• SIM Id (old/new)

and we were overwhelmed with the large number of scenarios that we should handle, like for example, if a registered user (old number) bought a new mobile (new Device Id) & wants to open our app there!

.. So, What is the best simple scenario for Mobile-App registrations using phone number?

Answer 1

The only scenario in which you could avoid a separate authentication mechanism (for example a password) is when the user has both devices or SIM cards at hand.

I assume sim card id is equal to phone number to keep it easy, you should have no problem to extend the examples.

• User has neither the old sim card nor the old phone. (For example after a year at a foreign country.) There is no way this user could authenticate himself without additional account settings.
• User has only the old sim card. (Old phone is broken or lost.) This is easy if only a phone number match is mandatory, else it's not possible to get the old device id.
• User has only the old phone. (Changed mobile provider.) If the user is still logged in, he might request a phone number change within your app. But you cannot require a verification by the old phone number. If the login expired, because the new mobile provider needed several weeks to setup, then the account is lost.
• User has both the old sim card and the old phone. If the user has multiple sim cards and mobile phones this is easy. If the user has only one mobile or SIM card, it requires multiple restarts and SIM card swaps.

If losing an account isn't a problem (the WhatsApp way), you could stick to the phone number or maybe even to a combination with the device id. But if you need durable accounts, you should introduce a separate authentication mechanism.

You need at least a password associated with the old phone number to create a recoverable user login. On manual login you could force your user to update their sim card id / device id / phone number immediately before resuming services.

Answer 2

If the user changes his/her phone, and want to continue its service, in such situation, system should validate the phone number by sending a confirmation message to the user. And once the user is validated against the new Device id and Sim ID then update these information in the system, so that previous app in the old device will become inactive.

Answer 3

My recommendation, if this is possible for you, is to include a user name or use their email address as a user name. Let's look at what this gets you if you do this.

1) If they get a new phone and maintain their old phone number, you can simply send them a text, have them respond in whatever way you want to prove it's them, and they're in.

2) If the get a new phone and a new number, they need only have their user name and specify that they have a new number. You send a text to the new number, they respond, and now their account is associated with the new number.

3) If they have an old phone with a new number, the process should be the same as #2.

People are used to user names and it's not a bad construct. It gives you a way to associate user information with something that's certain not to change.