-2

I know there are probably many existing answers to this question but so far I couldn't find a simple detailed answer.

On the android app there is two buttons, sign in with facebook and sign in with Google. When the user clicks either of these buttons, a request will be made to the fb/g+ api from the client using their sdk provided by fb/g+ and it returns a uniqueid, name, email, profile-img-url and gender.

after that, I use the user email and id to check if an account with the email and id exists or not. This is done with a php script that does a prepared sql statement. if the user exists then the script will return user data, if the user does not exists, I will send another request to another php script to sign up the user with all the details i got from the authentication.

I fear there are many security problems with this. I know that many apps have been through the same problem. I use a 10 digit id and the users email to sign in the user, can you please explain whether if there is any way that an attacker knowing the email could sign in to another users account. The attacker could also try multiple times because signing in a basic json request with the email and id as parameters. I could safeguards in the app that will prevent the users trying more than a few times but I think the ability for an attacker to try as much as they want is a risk, any suggestions to make it harder for an attacker to try multiple times in a small period of time?

closed as too broad by Ohnana, Matthew, Mark Buffalo, TildalWave, Xander Feb 17 '16 at 16:35

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    This is far too broad to answer. There are many, many things that might affect the security of your setup. – schroeder Feb 17 '16 at 16:07
  • @schroeder so there are lots of security vulnerabilities with my current way of authenticating the user? I'm sorry about the question being "too broad", this may be because of my lack of experience in the "information security" community. I didn't know that asking to list the vulnerabilities after explaining the way i authenticate the user would be "too broad to answer". I will try editing my question to make my question less broad. – edwinj Feb 17 '16 at 16:20
  • 1
    I'm afraid that you are taking this too personally. This particular Q&A site has some requirements for questions and answers (found in the FAQ). – schroeder Feb 17 '16 at 16:36
  • Ok sorry, I'm new to the "Information Security" community. Is my question still too broad? :) – edwinj Feb 17 '16 at 16:48
  • 1
    @edwinj How does the Facebook/Google authentication work? Is that a connection from your server to the provider, or from the client browser to the provider? What is the return value from this? Is the data you store provided directly from the provider, or via the client? Is the ID the same ID used by Facebook? Can an attacker make multiple attempts to log in (e.g. try id 1, then id 2, etc with a fixed email address)? All of these are questions raised from your question - I've not considered other potential issues. Try asking about one specific element of the process, perhaps. – Matthew Feb 17 '16 at 17:07
1

One major vulnerability is a MiTM (Man in The Middle) attack in which anyone who tries sniffing the packages between the user's phone and the computer hosting your database, will be able to gain the login credentials and information about the database host (like its IP). Then you have sql injection attacks and XSS if you haven't taken any precautions about that. Start by using POST instead of GET for sending data from php script to your db. Also, you can establish an encrypted connection between mobile devive and server using SSL or encrypt the data on the mobile device with a public key before sending them to the server for decryption. As for the sql injection attacks, make sure you check the data a user gives on the php form before sending them (use "mysql_real_escape_string()" for that purpose). Last, but not least take a look at that: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet or something similar to find out how to deal with XSS attacks.

  • Cheers!, I'm gonna use SSL, and I use prepared statements to prevent sql injection. Do you know of any other vulnerabilities? :) – edwinj Feb 17 '16 at 15:18
  • That site you link to is a known spam site. Not the best place to find security advice... – rene Feb 17 '16 at 16:38
  • @rene i dont really know about that site to be honest. Just wanted to point out the importance of xss security and found that link. – Chris Tsiakoulas Feb 17 '16 at 21:26
  • Sure, and we have a list of sites that are known to be posted by spammers hence your post was reported. You better find a different resource, for example the OWASP site: owasp.org/index.php/Cross-site_Scripting_(XSS) and remove that spammy one. – rene Feb 17 '16 at 21:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.