I'm building an mobile app that needs to communicate with a web service. To make sure that only my app is communicating with the web service, I authenticate using OAuth 2. The fact that I need to store a client id + secret in the app binary is unfortunate enough, but to retrieve an access token using OAuth 2 I need to send a client id and client secret to the server. Is it not very easy to:
- Fake an SSL cert and add it to the list a mobile device's trusted certificates
- Pretend to be the server and monitor the incoming requests
The request will contain the client id and client secret. Now I use these in some other app and communicate with my server.
Am I missing or not understanding something? Would I be better off using OAuth 1?