What is the most unique data identifier for a phone user that cannot be repeated?

Question

I'm currently developing an Android (and probably iOS in the future) application for my company.

I was wondering what is the most unique data identifier to authenticate the users. A data that cannot be repeated through users. For example:

• Email? That user can log in with another phone using the email and password

• Phone number? Could be the most unique one but it would required to verify the phone and I will have to setup a SMS validation service like WhatsApp

• IMEI? It pretty much validates the unique phone but it can be spoofed or replaced. Although I don't know if the application required permissions for this.

• Maybe a mix of all this methods?

My main goal is to save this data as a database and make it the primary key of it and with this know exactly who's the user that it's really using the company web services.

Answer 1

It sounds like you've got two problems that you're kinda rolling into one:

1. Device enrollment -- you need some way to know which user to register this device to, that's where the email or the phone number comes in. A valid user can register any device they want, as long as you can track the device somehow.
2. Fingerprint the device -- on subsequent logins, know whether it's the same device or a different device.

If you find the right google terms, I'm sure this is a problem that's been solved many times before.

I would assume that most solutions involve planting some kind of unique secret on the device during the enrollment step that can be checked at subsequent logins, like an API key or a client certificate.