A no-login approach to authenticating a certain device, MAC-Address as password?

Question

I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username together with 'some password' will be used to authenticate the user on every api call (using header fields, over SSL).

Is this a good way to authenticate the user with as little trouble for the user as possible? I believe whatsapp used a similar approach, using the device's MAC-address as the password, and let the user enter his phone number as username. I've also once read some critique on this approach, but if this is so bad, what is a better way of doing it?

So basically what i'm looking for is a way to do authentication with as little user input as possible (only a username), with at max one account per device, but for it to still be secure for calls to my api. Is there such an approach, if so, how would it go?

Answer 1

A MAC address is unsuitable for this for several reasons:

1. The MAC address can be changed freely by the user in software, and will change if the network hardware is replaced.
2. A wireless device broadcasts its address to everyone around, so it's hardly a secret.
3. MAC addresses are supposed to be unique, but in practice, they aren't.
4. A device with multiple network interfaces (say, a wireless card and an ethernet jack) will have multiple MAC addresses.

I'd look into something like client certificates, as mentioned by Dmitry Yanushkevich, or storing a unique token on the client as part of the account-creation process.