When we were writing an iPhone client for our web application, we were considering using the UDID as part of the authentication dialog with the server to allow for easy removal of devices if they get lost and to never have to re-prompt the user for their password.

In the end though, we decided against the UDID and just generated a random "installation id". This works much better in all regards:

1) when the user updates their device by applying an old backup to the new device, the app would continue to work exactly as before.

2) if the user wipes and sells their phone, the next user wouldn't automatically get access to the webapp if removing the device from the app was forgotten.

3) when something goes wrong and users try to reinstall the app, the user experience will be pristine, the server wouldn't know who you are.

4) the sometimes privacy sensitive UDID is never transmitted over a network.

5) it's not using deprecated APIs :-)