6

...or interactively asking for password / or having some certificate is inevitable?

Context

My Android app wants to do secure transactions via my Web Service API. However I do not want to bother my user with asking/registering passwords, neither asking to install certificates.

So here is a proposed solution, but I have serious doubts about it can not be faked.

Proposed solution

  • The connection between the my Android App and my server API is constrained to HTTPS
  • Before the App first communicates with the server it queries my App installation Id. All subsequent API call will have this unique id as first parameter.

Question(s)

Is it possible that any 3rd party (criminal, hacker) get know this installation id, (say installing an other malicious app on the very same device) so then can send fake requests to my server using any custom tool say a desktop app?

  • Why not just generate a random key, save it somewhere only your application can read it, and use that? Then you do not have to worry about a leaking "installation id". – Celada Mar 27 '16 at 15:05
  • Is there any place on an Android device what only my app can read? Including malicious apps, on breaked devices? – g.pickardou Mar 27 '16 at 15:06
  • 1
    What will you do if the user uninstalls/reinstalls the app or uses another device? – Neil Smithline Mar 27 '16 at 16:43
  • If your installation id is a fairly random one. it would clearly do the purpose and secure you. – Arun Anson Apr 26 '16 at 17:45
4

What an Attacker can do is , in a rooted device, decompile your apk and understand what is being communicated with the API to do Authentication or Identify the user in your back end. They can re-engineer that communication process in any application(Desktop or another mobile platform). Remember once some one installs your Android application in their devices , you do not have any control over that application.

Your solution would work in a controlled environment such as corporate network(Assuming you are installing the app only in known trusted devices). In public, I highly doubted your solution would work.

And according to the industry standards, it is not recommend to open up a public API (if your API is public) without any Authentication mechanism.

1

A malicious app on rooted device can read any certificate or password you will use to outsmart the enemies. Also in your scenario how will you know that the first request (the one that receives the API key) comes from a legitimate app and not from a hacker?

Within these limitations, a verified device id1 is not worse than anything else.


By device id I mean any id that is unique for the verified device. It could be the 64-bit android.provider.Settings.Secure.ANDROID_ID in raw format, or mixed with some app-specific string, or an MD5 hash of that, to make the request less obvious for casual observer.


Update: Given that the purpose of identification is to protect user's private data on the cloud, it is OK to return a user-unique "password" from the server on the first request, and use it later without manual login. Please use HTTPS for all requests, to protect from sniffing this password over the air.

But you should know that a determined researcher will be able to intercept the key, at least if she has physical access to the device, and can break the unlock protection.

If the "disk" is not encrypted, the key can be retrieved even from a bricked device.

  • I was talking about installationid, not deviceid. Device id is useless for my purpose, as it is publicly available for all apps, so any app can ask it, then impersonate my user by sending messages to the API from a desktop. *** About the first request: That is not a problem if a hacker made up an id, then sends request with that id. The problem to avoid if a user have an id, used that id, than a hacker impersonates the very same user and access her/his data – g.pickardou Mar 27 '16 at 16:33
  • So, the user does enter password on the first request? – Alex Cohn Mar 27 '16 at 16:35
  • 1
    No, there is not passwords at all. The point is not the restricting access to the API. There is no API password. The only goal to guard a user's identity and do not let anybody impersonate a user who already did transactions with a specific id. – g.pickardou Mar 27 '16 at 16:44
  • OK, your intent is more clear now. Please see the update. – Alex Cohn Mar 27 '16 at 16:55
  • Many thanks. If the "disk" is not encrypted and the device is vanilla unbricked, can a 3rd party application search and access my app's stored id on the "disk"? – g.pickardou Mar 27 '16 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.