While remembering usernames and passwords suck, so does having to wait for a text/email and going through another hoop. Any kind of friction in a sign up process is undesirable.
We have a similar-ish solution for a product we are building (empiric.al), except we don't even have the text/email. We server-side generate the device id & challenge when you connect the first time. That way the user is instantly in the app without any sign up.
Linking devices then becomes a secondary issue (similarly over email/sms, or optionally oauth) rather than a primary. Yes it is easier to abuse the system generating many empty sign ups, but it's just one of many ways people can abuse you. You still need something checking for abuse regardless.
Saving the auth info is then the problem. It's not so bad on iOS, because you have the Keychain that persists across uninstalls and get backed up. Android is a bit trickier -- there's no comprehensive way to preserve information across uninstalls (except BackupManager, which requires a Google login).
Still, you could give the user the option to defer creating user/pass until later with the understanding that their account is temporary until then.
We have a similar-ish solution for a product we are building (empiric.al), except we don't even have the text/email. We server-side generate the device id & challenge when you connect the first time. That way the user is instantly in the app without any sign up.
Linking devices then becomes a secondary issue (similarly over email/sms, or optionally oauth) rather than a primary. Yes it is easier to abuse the system generating many empty sign ups, but it's just one of many ways people can abuse you. You still need something checking for abuse regardless.