I am wondering what the difference is between WhatsApp and my Bank application, and what considerations determine what is the right approach to handle user authentication.

WhatsApp:

  • I create my account and don't have to login again
  • I change phone but keep my old number (same chip)
  • WhatsApp sends me a code because it is the same number and my account is active again
  • If my wife/girlfriend/mother/coworker gets the phone, they can see the conversations

BankApp:

  • I have to register and create an account with a login/password and use my card number to validate who I am
  • They send me an activation link to my email
  • I have to enter my login and password every time
  • I get logged out after 5 minutes of inactivity
  • If a thief points a gun at you, you still will give away the password

I'm developing a tracking app and my first thought was to create a login form so user needs to enter the login/password each time but now I think it is too cumbersome for user. Then I realized WhatsApp never asks me for anything and is always running when I start the phone.

So my approach now is such that the login page only appears once. The user inputs his login and if he is already register on the system, he gets the activation code. The app starts and doesn't ask for login again. The app also sends the ESN number to prove identity.

It is easy to use, but still has a problem if someone gets access to your phone, because they can know where are you been.

But again if they have access to your phone they can browse other things like your Google activity and that seem to be OK because you don't need to enter your password to open Google.

So When is it OK to have a system like WhatsApp, and when a more robust security like the Bank?

  • 1
    Banks are not a great example because many of their security features are required by law. For non-bank apps, this question is a matter of marketing more than anything else. – John Wu Jun 9 at 2:46
  1. I wouldn't use the ESN number to verify identity, ESN can be forged and can't be revoked if there is a breach/theft. Most services use some sort of secure token that can cryptographically (like an SSL cert) verify identity while also being able to revoked if the private key is compromised.
  2. Which approach to recommend depends on the kind of data your app handles. Think about how much of an issue it could cause if someone were to gain unauthorized access to the account. Would it potentially ruin someone's financial status (like a bank account, SSN, etc.) or would it just be a minor inconvenience (someone messes up your saved state on a game). If the damage from a breach would be high, the more security you can provide the better. For some types of data (Financial, Health, etc.) there may be laws dictating this behavior depending on your jurisdiction.

  3. Even if your default behavior is to not require login each time, consider making additional security available for the user to turn (require password each time, 2 factor auth, etc.) some users like having good security even if the data isn't that important.

  • I forgot about IMEI number can be forge. Can you tell me what should I google to get more information about the secure token process? I like the idea the add additional security as optional. – Juan Carlos Oropeza Jan 9 at 20:31

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.