Normally I would say we could adopt [UIDevice identifierForVendor] but that is iOS 6 only, but we still have to support iOS 5. The stuff we are doing already is what Apple recommends, when they set it for deprecation earlier.
You would think identifierForVendor is semi reliable -- it is not according to the Sep 24 2012 (yellow highlighted) update to this blog post:
.. which would be the same behaviour as our device.uuid solution if your customer ever only installs one app from you (which in most cases is true).
The advertisingIdentifier is similar to what the UDID is from before - but if you erase the device, it changes (rare) - but you can only use it for serving ads.
The keychain method shown below will survive app deletes, but not device erase:
You could also get the MAC address, and hash it with a known salt to obfuscate the MAC address if privacy is a concern I suppose. This would always generate the same value for the device.
I will be bringing this up to the dev mailing list to see if we want to change our device.uuid approach.