Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

i would like to have some advice on the following scenario:

I'm using kinvey as backend but because it doesn't provide the ability to run custom code i have set up another server. So basically when x happens on kinvey server, i send a call to my rest api on external server, do something, when done do a call back to rest api on kinvey.

Now i have a couple of questions actually:

I'm not using any sort of secure layer like SSL, i don't plan to use it in the near future because of i have no idea what kind of certificate i have to buy (any recommendations?)

Anyways:

What authentication should i implement so communication between the two are safe? As far as i know i could have the same key on each server and encrypt the data, as only the both servers know it, then it is secure? if so, which encryption should i use and why? (1)

Also i read that kinvey uses basic auth, which sends the password in plain text? This is not secure at all, so is it better to use their session authentication? (2) Or just buy an ssl certificate (what kind?) comodo essentialSSL ($29) vs RapidSSL ($49) for example? (3)

Thanks in advance!

share|improve this question
    
Use SSL. There are free certificates available, or if you don't use a browser as client you can even hardcode the expected certificate in the client or add a custom CA. –  CodesInChaos Nov 5 '13 at 21:04
    
Thanks for the comment. Can you recommend some places where i can get those free (and decent) certificates? –  Captain Obvious Nov 5 '13 at 22:28
    

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.