I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login.
I don't have SSL on my website, but it's just a reviews website and no private data is transmitted, nevertheless, on a mobile phone it seems more dangerous to me as mobile phones are always using a wireless network. and people sometimes use the same passwords for several websites.
What I want to do is: The app hashes the password twice, with two hashing algos which are considered secure, and then transmits it so at least if someone sniffs the data he can only use use it for my website, or maybe other websites which use the same hashing technique. maybe even more then twice, according to what is appropriate.
Is this a good idea?
and also, are mobile networks vulnerable to this kind of sniffing attacks? is there commonly some kind of protection like an SSL-like relationship with the network provider when someone just sits in a restaurant and is provided with a connection?