Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to prevent even a knowledgeable user from detecting MITM by hiding the HTTPS icon, replacing it with a favicon, or many other tricks since most many browsers completely hide the entire URL.

  1. Is a native application (perhaps with certificate/root cert validation) really the only way to achieve reliable, secure interaction with my back end services over HTTPS?

  2. Should I train my end users to not use a web browser, and use an "app" that is hard-coded to my URLs and optionally does additional certificate validation to reduce MITM risk?

  3. Should my web server go as far as detecting a mobile session, and prevent them from authenticating?

share|improve this question
1  
The mobile web browser can of course verify the authenticity as good as a "normal" one. The problem, as stated in the linked question, is that it may not show this information or let the site hide the real result. Of course that can be dangerous, but it's no "hackable" TLS/SSL. –  ordag Mar 9 '12 at 16:22
    
And what makes you assume that the native app would be more secure? Often it's really just a way of "hiding" the browser. But overall, this would be a usability tradeoff - for some, it would be annoying, and for others unusable (e.g. are you going to have a native app for WP7?). As usual, it depends on the usual tradeoffs, e.g. for a bank this might make sense, but otherwise not (perhaps). –  AviD Mar 13 '12 at 11:42
    
Besides, if you're really worried about this, why dont you just get a more secure mobile OS...? ;) –  AviD Mar 13 '12 at 11:45
    
@AviD Do any "secure mobile OS's" exist? ;) ... also I'd like people to think of this question not regarding their own personal device, but from a business who can't control what devices people use, but knows that fake "browser" pages have been created (akin to ebay hacks). Aside from spoofing a rogue app+icon, a dedicated app would ensure the user is connecting to my site and not a phishing site. In addition it could validate the SSL certificate (or chain) as well. Something a browser won't do as well. (See DigiNotar CA hack) –  makerofthings7 Mar 13 '12 at 13:04
    
@makerofthings7 - Windows Phone 8, Windows Phone 7, iOS, and Android are all secure. In all cases the certificate and security status ( i.e. https connection or http connection ) information is displayed to the user. There are many cases where a banking application was vulerable to Man in the Middle attacks because of a flaw in the program itself. –  Ramhound Feb 6 '13 at 13:05

3 Answers 3

A web app and a web browser both have the same problem- an attacker can subvert the data they send or receive.

I would not encourage forcing a user to use an app over a browser- I would take it the wrong way of a company tried to force me. I might not want to install an app, as part of my security policy.

share|improve this answer
    
...what if the App clearly displayed the connection security? No fudging the URL is possible since it's hard-coded in the app. –  makerofthings7 Mar 9 '12 at 22:23
    
I'm just emphasizing web apps since the browser can't see the URL clearly, and also the HTTPS status. I suppose in theory an app could use a client certificate (or additional encryption/CA Thumbprint checks) to ensure a safe connection –  makerofthings7 Mar 9 '12 at 22:26

No. there is absolutely no difference.

At the end of the day you need to expose the ablity for clients to query information and make state chagnes. The problems that an API that a mobile device uses is very similar to the problems that an API that a javascript/html browser uses.

You still have problems like insecure direct object reference and sql injection.

share|improve this answer
    
Updated the question to include risks on phishing, where using an app my be better than a website directly. –  makerofthings7 Mar 10 '12 at 13:39

If you are a web site developer looking to protect your users from phishing, there are some steps you can take.

The key step I would take is don't rely upon passwords. You can use, for instance, a secure persistent cookie, sent over HTTPS, to authenticate the user. SSL client cert authentication would be another example of a user authentication method that is resistant to phishing attacks because it does not rely upon passwords. If you prefer, you can additionally request a password, but you should not rely solely upon a password entered into a mobile browser. There are two reasons for this: first, passwords are phishable, and as you say, the decks are stacked against users; and second, entering passwords into a mobile device is a poor user experience, given the state of most soft keyboards.

If you are a user looking to protect yourself, there is a different set of defenses available to you, such as using a dedicated app, launching the site from a bookmark, and that sort of thing. However, it is probably not feasible for website operators to expect to train all of their users to follow those steps.

share|improve this answer
    
That do you think about Browser Certificates? ... a mutual trust here may improve things. –  makerofthings7 Mar 13 '12 at 23:25
    
Yes, client-side certificates are another way to prevent/defend against phishing attacks. –  D.W. Mar 14 '12 at 0:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.