I am wondering what the difference is between WhatsApp and my Bank application, and what considerations determine what is the right approach to handle user authentication.
- I create my account and don't have to login again
- I change phone but keep my old number (same chip)
- WhatsApp sends me a code because it is the same number and my account is active again
- If my wife/girlfriend/mother/coworker gets the phone, they can see the conversations
- I have to register and create an account with a login/password and use my card number to validate who I am
- They send me an activation link to my email
- I have to enter my login and password every time
- I get logged out after 5 minutes of inactivity
- If a thief points a gun at you, you still will give away the password
I'm developing a tracking app and my first thought was to create a login form so user needs to enter the login/password each time but now I think it is too cumbersome for user. Then I realized WhatsApp never asks me for anything and is always running when I start the phone.
So my approach now is such that the login page only appears once. The user inputs his login and if he is already register on the system, he gets the activation code. The app starts and doesn't ask for login again. The app also sends the ESN number to prove identity.
It is easy to use, but still has a problem if someone gets access to your phone, because they can know where are you been.
But again if they have access to your phone they can browse other things like your Google activity and that seem to be OK because you don't need to enter your password to open Google.
So When is it OK to have a system like WhatsApp, and when a more robust security like the Bank?