Are these ids in plaintext in network requests? What if someone at Starbucks snoops my request? What if someone steals/guesses my id while I still have the same device, how do I do the equivalent of resetting my password?
Ok, but no way to handle the case where it is comprimised? Why use the device id, why not just generate a uuid the first time the app is run? It seems like there are some issues to work out with this scheme, it may be slightly premature to declare logins dead.
