0

I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username together with 'some password' will be used to authenticate the user on every api call (using header fields, over SSL).

Is this a good way to authenticate the user with as little trouble for the user as possible? I believe whatsapp used a similar approach, using the device's MAC-address as the password, and let the user enter his phone number as username. I've also once read some critique on this approach, but if this is so bad, what is a better way of doing it?

So basically what i'm looking for is a way to do authentication with as little user input as possible (only a username), with at max one account per device, but for it to still be secure for calls to my api. Is there such an approach, if so, how would it go?

1

1 Answer 1

3

A MAC address is unsuitable for this for several reasons:

  1. The MAC address can be changed freely by the user in software, and will change if the network hardware is replaced.
  2. A wireless device broadcasts its address to everyone around, so it's hardly a secret.
  3. MAC addresses are supposed to be unique, but in practice, they aren't.
  4. A device with multiple network interfaces (say, a wireless card and an ethernet jack) will have multiple MAC addresses.

I'd look into something like client certificates, as mentioned by Dmitry Yanushkevich, or storing a unique token on the client as part of the account-creation process.

2
  • About the unique token, how would you recommend creating it? I was thinking about a purely random n-bit token, stored in a keystore on the client-side, which is sent to the server during creation And every api call. The server only stores a hashed version of the token in it's database.
    – user717572
    Jul 11, 2014 at 14:48
  • @user717572 I think what you are looking for is something along the lines of an RSA key pair, and the server would store the public key as opposed to a hash Oct 11, 2015 at 15:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .