Solution 1 :
there are known devices/models which were distributed to the market with same ANDROID_ID
, so this way isn’t safe to use as auto-login param. Android team noticed that setting ANDROID_ID
by hardware producer isn’t reliable, thus changed this behavior in Oreo, so on devices with 8.0+ its reliable, on lower isn’t
note that even on Oreo and later ANDROID_ID
MAY change e.g. when system is updated and your app will be uninstalled (different id before and after OS update)
edit due to comment:
well, on Oreo+ devices I think you can rely on ANDROID_ID
– OS updates are rare and also there is a really small chance that someone uninstall your app, gets OS update and then install again your app…
for older devices I’ve done similar feature like you need few years ago – I was storing some data on external storage (sd card or internal) in hidden folder (Linux, so .
before name is sufficient). after app (re)install I was looking at first for saved data and restoring if found. it may be some ANDROID_ID
equivalent + maybe some cryptography or checksum-integrated for more inquisitive users…
this approach will work on older devices, on which storage access policy is pretty “loose”. newer OS version releases were introducing new limitations in this topic, e.g. Scoped Storage in Android 10. you can still have access to “raw”/all data stored on sd/internally, but you need some permissions and this may look suspicious to the user and prevent installing (imho correct approach). but on Android 7 and lower I think you can “find a place” to store some hidden/encrypted data for restoring later 😉 note that this way may even “rescue” your app when user wipe out all data
some docs about (persistent or not) storing data in HERE. you can find there useful table with Files removed on app uninstall?
column and more info about storing and limitations. good luck 🙂
Problem :
I would like to make an application without registration and if possible, when the user uninstalls and reinstalls the application, be logged in again.
I could read that there is the ANDROID_ID which never changes.
But then, I ask myself a question:
Is it safe to use ANDROID_ID as a way to connect the user?
I’ve read that starting with android 8.0, the behavior of ANDROID_ID has changed and is now generated based on the bundle and the signature of the application.
But before android 8.0, isn’t there a security issue due to the fact that, if I understand correctly, all applications share the same ANDROID_ID?
Comments
Comment posted by Viktor Jovanovic
Hey, thank you for your answer! Very useful! My question now is: How does an application like Whisper get a login system without registration? Knowing that if I uninstall and reinstall the app, both on ios and android, I get my account back!
Comment posted by snachmsm
check out answer edit (too much text for comment 🙂 )
Comment posted by Viktor Jovanovic
I couldn’t get a better answer than yours! Thank you very much!