I'm working on an iOS app that will also have a web component. When a user creates an account, their password will be salted and hashed. I already have the hashing algorithm working on the web-side.
When a new user creates an account in the app, should the iOS app hash their password and send that to the server to be directly inserted into the database? Or should their password be sent to the server in plain-text, and hashed there? Should it be encryted in-app, sent to the server, decrypted, then hashed? I'm just not sure what the best and most secure protocol is. I guess the same question goes for authenticating an existing user trying to sign in.
Also, at this point I don't have SSL set up on the server, but I'm certainly willing to do that if it helps with this.