Problem: identify and authorize a user of my app connected to my server.
Some considerations which I have done.
Users do not like to give his email.
I would like that the user could start the app and, if it were not the first start ever, could directly access the Server (a game on the Server).
I could use a UUID created from the app, but there is not a way to save it without the risk of it being deleted. In addition, there is no absolute certainty of always getting a different UUID (if my app was installed on 100 million devices? Since it will not be free, I shall become quite rich, but that's another story
In addition, an attacker could send the UUID randomly. The server, receiving this UUID and not finding it in the relative DB, should consider the user as a new user and accept and store the UUID.
I do not find the ideal solution, especially from the point of view of safety.
Some considerations which I have done.
Users do not like to give his email.
I would like that the user could start the app and, if it were not the first start ever, could directly access the Server (a game on the Server).
I could use a UUID created from the app, but there is not a way to save it without the risk of it being deleted. In addition, there is no absolute certainty of always getting a different UUID (if my app was installed on 100 million devices? Since it will not be free, I shall become quite rich, but that's another story
In addition, an attacker could send the UUID randomly. The server, receiving this UUID and not finding it in the relative DB, should consider the user as a new user and accept and store the UUID.
I do not find the ideal solution, especially from the point of view of safety.