But when it does go away (app reinstalls, phone upgrades, phone breaks etc), it causes a disproportionately catastrophic event: complete loss of access. Providing a simple email address would prevent this, but expecting the common user to have the wisdom on account recovery strategies is too optimistic. That's why many apps ask for email during registration.

That can be tolerable for Discord, because your loss is just your friends list and access to some servers, which can be recovered easily through social means. That's not possible or feasible for every kind of app.

Discord basically copied IRC and added voice chat. One didn't need an account for IRC why should they need one on Discord? Maybe to retain their nickname but that's it. And it was just a password, no email no phone number no nothing else.

I really liked the temporary and anarchic nature of IRC. No one was really in control.

The next logical step would have been to make it encrypted and add p2p voice chat via DCC or some other method. SILC tried the former but failed to gain traction, people either stuck with IRC or moved on to AIM and Yahoo Messaneger.

You can easily offer an optional data safeguard feature for account restoration.

This is especially pronounced now that application sync between devices is more or less universal on iOS and (to a lesser extent) Android.

To the layman, the intuitive perspective is that it "just works" and is exactly how they left it previously, regardless of whether they have wiped their phone or replaced it. This isn't a dig at tech illiterate people but it is just how things are for the normal person. Hell I have been almost burned by this in the past when I moved phones and a certain app(FGO)'s data didn't transfer over.

TLDR The most intuitive thing is working out of the box and seamlessly transferring to a new device. The easiest way to do this is to allow it to be bound to a user's Google account, Microsoft account, and Apple ID.

Those little security-by-securing-all-handset mechanisms kind of worked while there weren’t any publicly known rooted phone, in the wild, that can establish a session on featurephone APN, but emergence of iPhone and Android extinguished it.

I know of at least one carrier, but is only usable for their own customer self care portals/apps. There it is possible to auto-login to their app if it is accessed via their network and not via Wi-Fi. For security reasons only a limited amount of functionality is accessible. Neither customer data can be changed nor can any actions resulting in additional cost (buying packs / options) be performed without additional authentication mechanism of a higher security level (auto-login via SMS or use of a password).

The MSISDN is only added to the HTTP request internally in their secure network and never exposed externally.

Like, have http://my.number/ return the phone number for identification (though it would need some permission, I don't want every app to have access to it).

Make a HTTP POST with some data to http://my.number/validate and have it signed by the carrier, validate it against a list of public keys per carrier. Not sure why that wouldn't work today? It could even be a private/reserved IP address routed by all carriers to their auth service.

Edit: obviously, it wouldn't work over Wi-Fi without some cooperation at the OS level.

The idea is that, they already created an account by launching your code, so you don’t have to ask for account creation. Just ask for the information that is necessary to run your services and you can provide an optional method for account recovery.

Probably better if the browser started to come with an e-mail set in it - then web admins can query for that and users have the option to change the email when they so choose...

So, the users who switch from iphone to an iphone don’t loose anything if they follow the default upgrade process.

Sounds great while iCloud is up/you use iOS...prepare for the shitestorm when its not or the user decides to leave Apple... 'Easy' and 'Convenient' won't be the terms anyone is using.

Give me a proper website with a proper email/password/WebAuthN & SSO signup. I don't want the app, I don't want any of it.

Websites are simply apps installed in the browser without asking for permission. Notorious for tracking abilities, data storage tied to the browser, performance lower, capabilities limited to browser api, data consumption unpredictable, identification tied to web technologies.

Some people may want just that, I don’t judge.

That actually work on the platforms I choose. There are many apps that only work on iOS/Android that I want to run on my desktop or a more pure linux phone. I just want to be able to consume a service from a platform that clearly have the technical capabilities to do so, but no, it has to be a "app".

> Notorious for tracking abilities

And a lot easier to chose/disable them. This summer many apps (including stuff like spotify) would not even start on iOS because the facebook SDK crashed. On the spotify web player I can choose to block calls to recaptcha, facebook and similar with umatrix. Do you think that apps on average have less tracking or just that you tend to pay for apps but not for webapps and therefore get higher quality apps?

> data storage tied to the browser

Great! Data storage on the client should either be treated as unreliable or the only storage (for stuff where there is no "cloud" or privacy is critical). Tying storage to a single vendor (like icloud or google drive) is a very, very bad idea. Web browsers also have a well defined interface for you to inspect the data saved locally if you want.

> performance lower

For the majority of apps this does not matter. The reason webapps are usually slow is not that the platform is slow, it's that companies copy websites that are stuffed with tracking (if you block that they tend to be much quicker). They suck because the people who made them made them suck.

Most chat, mail, news, or any other form of text/image/video app could easily be performant enough as a webapp. Hell, amazon even made their real time game streaming service a webapp. The platform is not the problem.

> data consumption unpredictable

Not sure what is different here from native apps? Both can auto-update, both can download assets at-will, right?

> identification tied to web technologies

Yes please! That means it's portable and not tied into google/apple!

A native app has every opportunity a webapp has to track you and much more.

> data storage tied to the browser

So? Browsers make it as easy to clear the storage of a webapp as it is to clear the storage of a native app. If you are talking about PC apps it is even easier to clear webapps' storage than native apps. If you mean it is bad because the stored data can disappear from the users device, that is what the localstorage API is for. Browsers will only delete that data if the user tells them to. This isn't any different from native apps having to deal with users deleting their files.

> Performance lower

While I have to admit that for raw computation webapps are slower than native, most apps don't need that much raw computational power and WASM should bridge the gap to native performance for apps that do need it. If your webapp is slow it is by far more likely you did a poor job programming it, not that you are limited by web performance.

> capabilities limited to browser api

Browser APIs are expanding all the time (except on iOS Safari but Apple has a vested interest in crippling webapps). And again, most apps don't need deep access to a system and the few that do shouldn't be webapps anyway.

> data consumption unpredictable

This has absolutely nothing to do with if an app is a webapp or native. Native apps can suck down data like crazy while webapps can use almost none and vice versa.

> identification tied to web technologies

Not really? Name one form of widely used identification that webapps don't support. You can use emails, usernames, 2FA, security fobs.

edit: remove snark at the end, it didn't add anything.

Nope, an iOS app can’t leave a cookie that other apps can use to identify me.

Clearing storage is not the issue, making sure that the storage is not accidentally cleaned is.

The data consumption of an app is predictable because the download size would be listed in the appstore. On a website, it could be anything and the only way to find out is to load it. You can check out the data usage after install in iOS but there’s no easy way to do it for websites.

Maybe not directly, but by using something like the Facebook SDK the same effect can be achieved by shipping your advertising identifier off to Facebook who then does the tracking server side using events generated by the Facebook SDK. This is in tons of apps and you have no way of knowing it as an end user without reading the privacy policy or reverse engineering the app.

> Clearing storage is not the issue, making sure that the storage is not accidentally cleaned is.

This is just as much of an issue on native apps as it is with webapps, browsers wont clear local storage for a website unless the user requests it just like how a native apps storage won't be cleared unless a user requests it.

> The data consumption of an app is predictable because the download size would be listed in the appstore. On a website, it could be anything and the only way to find out is to load it. You can check out the data usage after install in iOS but there’s no easy way to do it for websites.

Just because the App Store download size is predictable doesn't mean the final download size is, lots of apps download a bunch of extra assets on first launch or even regularly as you are using them. I also couldn't find a way to check data usage of apps or websites on WiFi on my iPad so that isn't really a point either way.

> - Advanced Persistent Device Identification: Identifies individual mobile devices for both iOS and Android platforms, even if they have been reset or if the application has been reinstalled.

> - verifies the integrity of the application in which it is embedded to ensure it has not been modified or infected. It also analyzes all other apps installed on the device, and reports their reputation and the presence of any malicious code.

There is no iOS API that allows them to do this. Apple removed it years ago: https://appleinsider.com/articles/15/06/24/apple-expanding-u...

Being able to know in what I am getting in and tapping install is much, much better experience than tapping on a link to the unknown then trying to figure out how to reach the thing I am looking for when the website tries to track me, monetize me, make me sign up all at the same time.

A website would usually load about the same size data of a native app without a warning and would report me to facebook, google and others.

That’s not something I am thrilled about.

Why do you think native apps are not like that?

Many apps load SDKs from google and (especially) facebook. They often load a lot of assets from servers.

For websites, this is not an option.

Option A: Only runs on one platform, can only be published on that platform with the blessing of the manufacturer of your device and little-to-no insight into data usage

Option B: Cross platform, can be interfaced with using open standards and block parts of it that you want (not just on a DNS level, but on a resource level)

I really don't see why you would prefer A?

If you’re building a service that’s not suitable for option A then you use option B. It’s not really a discussion at that point.

I’m glad that there’s an option B the way that I am glad that there’s frozen pizza in the fridge. Good to have it but I’m not gunning for it if a proper restaurant pizza is available.

There are a number of pseudo vpn like apps that give you similarish control over native apps just the same as an extension on a web browser that uses hostname blocklists.

I don't believe a website can upload your contact list, upload a list of apps on the device, log your GPS location or record using your camera or microphone. Is this no longer true?

Requires an opt-in permission on native, for browsers with support, it would also be an opt-in permission

> upload a list of apps on the device

Not possible on iOS for a native or web app. Depends on a number of factors on Android.

> log your GPS location or record using your camera or microphone.

Possible for native and web apps, but only after explicit opt-in permission.

End result, no meaningful difference between native and web for any of your examples.

True AFAIK.

> log your GPS location or record using your camera or microphone. Is this no longer true?

Depends on what you mean. This is fully possible on many phones and only needs approval from the user.

Then again approval from the user seems to be becoming the standard in installed apps as well.

That said, I much prefer web pages for things that need cloud or apps/desktop applications that works offline for the rest.

I don't know where you are, but in the US it is actually illegal for a bank to offer financial services without collecting a significant amount of personal data from the customer. This exists for a few reasons but I think the most significant one is that the government does not want to give up the ability to block financial transactions for those they deem unacceptable. (Like terrorists.)

It all makes sense, they are required to know me for AML reasons, so the account creation step collects this data.

The bank is mobile first, so the account is activated through the app when my card arrives. Why would I have a username and password for the app that is used to create the account in first place? The app can keep it for me without exposing it to me ever. I can’t be phished for something that I don’t know and it is one less password to remember or take care.

> Please don't post comments saying that HN is turning into Reddit. It's a semi-noob illusion, as old as the hills.

You then have to record a video selfie saying something like "I am NAME and I want to recover my account" and then send a pic of an ID. Same process (the selfie+ID part) for if you want to display your card PIN reminder.

As an occasional discord user: yes, exactly. That's how Discord syncs communities and read messages between my phone, tablet, and computer, either via app or web client.

This is a huge convenience over say IRC where (last time I looked) the way to get any client-side consistency is to run a personal 24/7 relay on your own server and use special clients to connect to that instead of the main IRC server.

Which is the setup equivalent of not wanting a Dropbox account because "you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem."

Why would I want every single thing I do online to be directly linked to one physical real world device?

It's not so much about data loss for me but I don't want anything real world linked to me to be used to authenticate me in any way other than monetary transactions or things with tangible physical value.

Other than that, I have a range of email addresses and usernames I use depending on the nature of the site and the amount of personal information i'm willing to disclose.

I have a fairly fine grained system for managing my user accounts accross various platforms and i'm personally finding it more and more aggravating the amount of places that require some kind of google or facebook sign in, let alone the idea that my phone should be my universal user account/name.

The internet should be like the rest of public life. For the most part, in my day to day life, I get to choose the amount of personally identifiable information I disclose to others. Managing multiple user accounts with differing levels of personal information is the internet equivalent of this.

I do not wish to be linked to one 'universal digital me' my real life interactions are not like that, why should my internet interactions be forced to be that way?

I have different groups of friends, acquaintances, coworkers etc. I don't act the same way with all of them, I don't talk about the same things with all of them, they don't all have the same level of information about my life, yet increasingly, online interactions are being pushed into this 'one you for everyone and everything' paradigm that is completely antithetical to the original values of the early internet and human interaction in general.

- The app is used on one device

- Only one user has access to a device

- There is a convenient or reliable way to identify a device for all platforms you target

Plenty of apps can live with those, and plenty can't. email address is one of the least bad ways to do it.

It might just be a matter of boilerplate. The permissions and usernames are (in code, in legalese, etc) may be tied to the concept of a signup. They might have investors, advisors or whatnot asking about weekly registration trends or somesuch. They may have a regulator, and the regulator assumes that you have info.

Even banks are increasingly getting regulator-ish. You may need to produce a "know-your-customer" policy.

Anonymity just isn't done anymore.

Passive voice alert! By whom? Site/app producers can, with certain exceptions, choose to allow anonymity.

That's an understatement, if I ever saw one.

> Anonymity just isn't done anymore.

When was banking anonymous? In the days of Bonnie and Clyde? :-)

what more are you typically putting in, other than an email address, maybe a username for uniqueness, etc...?

You can use firebase accounts to manage that. Start with the anonymous account which will create an account with a random UID and use the mechanism to convert the accounts into “registered”. Pretty easy, you don’t even have to create your own custom solution.