Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Let's say I have a really simple mobile app with a server API. For example some kind of Q&A app, where users answer questions to win some points ('Who wants to be a Millionaire' kind of game).

Users can download new questions from a server's API. Next, the users can upload new questions they made up to contribute to a common database of questions.

I was pretty much always taught to use a HTTPS on production servers. However: do I really need to use HTTPS with some kind of security token in this case? Is there a way to inject some malicious questions if simple HTTP is used? Or other threats?

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

Do you care if a 3rd party monitors or modifies a request in transit from the client to you or from you to the client?

If you don't care, just use HTTP. If you do care, use HTTPS.

Is there a way to inject some malicious questions if simple HTTP is used? Absolutely, the real question is does it justify the extra cost of developing a HTTPS system to prevent that from happening? (most of the time the extra cost to implement HTTPS over HTTP is so minimal the answer to the question usually is "yes, the cost is justified")

share|improve this answer
    
Got it. By the way the attacker could inject the malicous questions only to specific devices right? For example on local network. However he couldn't replace all the questions I send from our API. He could of course submit a lot of fake questions to my server, but I could handle that before sending (suppose there would be some kind of "approve" proccess). –  tsusanka Dec 6 '13 at 10:22
    
Yes, essentially the attacker would be in a privileged network position (e.g. on the same local subnet as the user) and would either sniff the traffic, or perform some kind of spoofing (e.g. ARP / DNS spoofing) to intercept and modify traffic. I still generally recommend HTTPS anyway, because the overhead and cost is minimal - there's not much of a reason not to use HTTPS! But it's not critical in this case. –  Polynomial Dec 6 '13 at 10:35
add comment

Do you use any authentication for your API? If you do, then you should consider leakage of users credentials.

OAuth 1.0a lets you stay safe from this, as private key is never transmitted, but is used to create cryptographic signature instead. With OAuth2 or "classic" authentication schemes your users credentials are transmitted in clear-text and you have to protect them with HTTPS.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.