Ask HN: Is Whisper App criminal?

Recently I installed the Whisper App on my iPhone. After deleting and re-installing it, I noticed that the account was completely restored by default. This was already suspicious, since Apple doesn't allow devs to access programatically the handset's unique ID. The implication was that Whisper was using another technique to generate a fingerprint that was unique to my handset.

Later, I installed Whisper on another iPhone I owned. Oddly enough, the App asked whether I used it in the past. Answering "Yes", I was presented with a short list of usernames and asked which one was mine. Sure enough, the username I used on the first iPhone was in that list. Consequently I was able to easily restore my profile on the new device. The profile included my posts, activity and private messages.

Here's the truly upsetting part: in the same list, there was another username, which I had used 2 years ago, on an iPad (I deleted the iPad App over a year ago).

After some googling, I found this blog about the App[1]. The post links to a separate article by The Guardian, equally shocking.

I know that The Guardian article at least has been posted here before, and the consensus was that it was unacceptable what Whisper was doing[2]. This was a few years ago. It seems that the team at Whisper has since become even more competent at bypassing several of the protection layers implemented by Apple.

My question is, at which point does it become criminal behaviour on the part of the App developers? I feel what Whisper does cannot possibly be acceptable. What can be done about this? What should be done?

Here's one last fascinating bit about the App: The only way to delete your account is by e-mailing them the request (using your e-mail address, duh!). Furthermore, "deleting your Whisper account will prevent you from joining the Whisper community in the future on your device." That's crazy!

[1]http://bit.ly/2g0qD67

[2]http://bit.ly/2fH5pJd