Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on external server, do something, when done do a call back to rest api on Kinvey.

I'm not using any sort of secure layer like SSL, and I don't plan to use it in the near future because I have no idea what kind of certificate I have to buy

What authentication should I implement so communication between the two are safe? As far as I know I could have the same key on each server and encrypt the data, as only both servers know it, then it is secure? if so, which encryption should I use and why?

Also I read that Kinvey uses basic auth, which sends the password in plain text? This is not secure at all, so is it better to use their session authentication? Or just buy an ssl certificate (what kind?)

share|improve this question
Use SSL. There are free certificates available, or if you don't use a browser as client you can even hardcode the expected certificate in the client or add a custom CA. – CodesInChaos Nov 5 '13 at 21:04
Thanks for the comment. Can you recommend some places where i can get those free (and decent) certificates? – Captain Obvious Nov 5 '13 at 22:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.