2 added 1667 characters in body
source | link

Hrm. On top of the SSL I'm not sure what you're really getting from the API_SECRET here.

I would think that having a server SSL certificate from a known, trusted source would be the best you can do here, assuming that your client app is distributed in a trust worthy manner. At that point, the client can check the server's authentication via the SSL session, and the server authenticates the client with the username/password.

As @Polynomial says - SSL should encrypt the session such that MITM attacks between the SSL endpoints is not an issue. Trick is knowing where those endpoints are located and being sure that they are located in your infrastructure in a well-thought-out location. For example, if there is an SSL end point in front of the apps server - what protects that last mile of transmission?

Similarly - is the application (mobile or web) properly checking that the server's SSL cert is from a trusted source?

Addition for question in the comment:

I took a look at the Class Reference for NSURLReference on the Mac Development pages and couldn't find any reference to SSL at all... in fact the comments specfically say it's protocol independant, which makes sense given that it's called URL Request.

I don't think you can assume you even have HTTPS with this class - you're going to have to do something to set up the HTTPS session instead of defaulting to HTTP. Here's the Mac Developer overview on SSL. It's bugging me a bit, because there is no obvious function for getting the server's certificate.

Then you'll also need the Certificate, Key and Trust services - to verify the certificate.

I would NOT assume that the Apple development environment will just do this for you. Previous experience with other APIs has given me no reason to trust this and I'm not seeing the documentation that says what it does explicitly. I'm not even particularly sure how trust stores work in this development environment. And this isn't a place where you want to make blind assumptions. I'd look into under what conditions the environment forces SSL, verifies the authenticity of server certificates and verifies that the certificate is signed by a trusted CA. If you don't have documentation telling you when and how these things happen, you can't really assume your service is secure.

Hrm. On top of the SSL I'm not sure what you're really getting from the API_SECRET here.

I would think that having a server SSL certificate from a known, trusted source would be the best you can do here, assuming that your client app is distributed in a trust worthy manner. At that point, the client can check the server's authentication via the SSL session, and the server authenticates the client with the username/password.

As @Polynomial says - SSL should encrypt the session such that MITM attacks between the SSL endpoints is not an issue. Trick is knowing where those endpoints are located and being sure that they are located in your infrastructure in a well-thought-out location. For example, if there is an SSL end point in front of the apps server - what protects that last mile of transmission?

Similarly - is the application (mobile or web) properly checking that the server's SSL cert is from a trusted source?

Hrm. On top of the SSL I'm not sure what you're really getting from the API_SECRET here.

I would think that having a server SSL certificate from a known, trusted source would be the best you can do here, assuming that your client app is distributed in a trust worthy manner. At that point, the client can check the server's authentication via the SSL session, and the server authenticates the client with the username/password.

As @Polynomial says - SSL should encrypt the session such that MITM attacks between the SSL endpoints is not an issue. Trick is knowing where those endpoints are located and being sure that they are located in your infrastructure in a well-thought-out location. For example, if there is an SSL end point in front of the apps server - what protects that last mile of transmission?

Similarly - is the application (mobile or web) properly checking that the server's SSL cert is from a trusted source?

Addition for question in the comment:

I took a look at the Class Reference for NSURLReference on the Mac Development pages and couldn't find any reference to SSL at all... in fact the comments specfically say it's protocol independant, which makes sense given that it's called URL Request.

I don't think you can assume you even have HTTPS with this class - you're going to have to do something to set up the HTTPS session instead of defaulting to HTTP. Here's the Mac Developer overview on SSL. It's bugging me a bit, because there is no obvious function for getting the server's certificate.

Then you'll also need the Certificate, Key and Trust services - to verify the certificate.

I would NOT assume that the Apple development environment will just do this for you. Previous experience with other APIs has given me no reason to trust this and I'm not seeing the documentation that says what it does explicitly. I'm not even particularly sure how trust stores work in this development environment. And this isn't a place where you want to make blind assumptions. I'd look into under what conditions the environment forces SSL, verifies the authenticity of server certificates and verifies that the certificate is signed by a trusted CA. If you don't have documentation telling you when and how these things happen, you can't really assume your service is secure.

1
source | link

Hrm. On top of the SSL I'm not sure what you're really getting from the API_SECRET here.

I would think that having a server SSL certificate from a known, trusted source would be the best you can do here, assuming that your client app is distributed in a trust worthy manner. At that point, the client can check the server's authentication via the SSL session, and the server authenticates the client with the username/password.

As @Polynomial says - SSL should encrypt the session such that MITM attacks between the SSL endpoints is not an issue. Trick is knowing where those endpoints are located and being sure that they are located in your infrastructure in a well-thought-out location. For example, if there is an SSL end point in front of the apps server - what protects that last mile of transmission?

Similarly - is the application (mobile or web) properly checking that the server's SSL cert is from a trusted source?