Timeline for Is an API password safe in a mobile application?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 30, 2017 at 16:40 | answer | added | Skip Hovsmith | timeline score: 1 | |
| S Oct 27, 2017 at 13:40 | history | suggested | GAD3R | CC BY-SA 3.0 |
title formatted
|
| Oct 27, 2017 at 13:04 | review | Suggested edits | |||
| S Oct 27, 2017 at 13:40 | |||||
| Oct 27, 2017 at 10:51 | comment | added | Hector | From a Man in the Middle point of view as long as the code doesn't ignore invalid certificates and the attacker does not have the ability to modify files on the device (either the application or operating system / root certificates) then the connection should be secure. Its also worth forcing your server to only accept SSL connections - possibly logging and notifying for unencrypted attempts. | |
| Oct 27, 2017 at 10:47 | answer | added | Hector | timeline score: 6 | |
| Oct 27, 2017 at 10:47 | comment | added | Guesser | I suppose also I am asking if SSL is compiled into the app itself so there is no way of tricking the app to send info that was meant to be encrypted in plain text. | |
| Oct 27, 2017 at 10:29 | comment | added | Guesser | So even in the compiled code it could be extracted? That is really my question. | |
| Oct 27, 2017 at 10:20 | comment | added | Hector | So you're worried about your clients users? If the token is stored on a users device (either as a file, in the compiled code or even just in memory) that user can in theory extract it. This is the same whether a desktop application on a PC or on a mobile device. If you only want hardware controlled directly by your clients to call the API they would have to forward requests via their own API/server infrastructure. | |
| Oct 27, 2017 at 10:14 | comment | added | Guesser | I'm not trying to stop clients developing their own applications, the API is limited enough for them not to be able to clone the service. I'm only concerned about the clients API keys being stolen from the code in the mobile app, if that is indeed possible. | |
| Oct 27, 2017 at 9:59 | comment | added | Hector | If they already have API keys and they are developing their own applications other than through TOS how would you stop them doing this? | |
| Oct 27, 2017 at 9:57 | history | asked | Guesser | CC BY-SA 3.0 |