7

...or interactively asking for password / or having some certificate is inevitable?

Context

My Android app wants to do secure transactions via my Web Service API. However I do not want to bother my user with asking/registering passwords, neither asking to install certificates.

So here is a proposed solution, but I have serious doubts about it can not be faked.

Proposed solution

  • The connection between the my Android App and my server API is constrained to HTTPS
  • Before the App first communicates with the server it queries my App installation Id. All subsequent API call will have this unique id as first parameter.

Question(s)

Is it possible that any 3rd party (criminal, hacker) get know this installation id, (say installing an other malicious app on the very same device) so then can send fake requests to my server using any custom tool say a desktop app?

Improve this question
4
  • Why not just generate a random key, save it somewhere only your application can read it, and use that? Then you do not have to worry about a leaking "installation id".
    – Celada
    Commented Mar 27, 2016 at 15:05
  • Is there any place on an Android device what only my app can read? Including malicious apps, on breaked devices?
    – g.pickardou
    Commented Mar 27, 2016 at 15:06
  • 1
    What will you do if the user uninstalls/reinstalls the app or uses another device?
    – Neil Smithline
    Commented Mar 27, 2016 at 16:43
  • If your installation id is a fairly random one. it would clearly do the purpose and secure you.
    – Arun Anson
    Commented Apr 26, 2016 at 17:45

2 Answers 2

Reset to default
4

What an Attacker can do is , in a rooted device, decompile your apk and understand what is being communicated with the API to do Authentication or Identify the user in your back end. They can re-engineer that communication process in any application(Desktop or another mobile platform). Remember once some one installs your Android application in their devices , you do not have any control over that application.

Your solution would work in a controlled environment such as corporate network(Assuming you are installing the app only in known trusted devices). In public, I highly doubted your solution would work.

And according to the industry standards, it is not recommend to open up a public API (if your API is public) without any Authentication mechanism.

Improve this answer
1

A malicious app on rooted device can read any certificate or password you will use to outsmart the enemies. Also in your scenario how will you know that the first request (the one that receives the API key) comes from a legitimate app and not from a hacker?

Within these limitations, a verified device id1 is not worse than anything else.

By device id I mean any id that is unique for the verified device. It could be the 64-bit android.provider.Settings.Secure.ANDROID_ID in raw format, or mixed with some app-specific string, or an MD5 hash of that, to make the request less obvious for casual observer.

Update: Given that the purpose of identification is to protect user's private data on the cloud, it is OK to return a user-unique "password" from the server on the first request, and use it later without manual login. Please use HTTPS for all requests, to protect from sniffing this password over the air.

But you should know that a determined researcher will be able to intercept the key, at least if she has physical access to the device, and can break the unlock protection.

If the "disk" is not encrypted, the key can be retrieved even from a bricked device.

Improve this answer
6
  • I was talking about installationid, not deviceid. Device id is useless for my purpose, as it is publicly available for all apps, so any app can ask it, then impersonate my user by sending messages to the API from a desktop. *** About the first request: That is not a problem if a hacker made up an id, then sends request with that id. The problem to avoid if a user have an id, used that id, than a hacker impersonates the very same user and access her/his data
    – g.pickardou
    Commented Mar 27, 2016 at 16:33
  • So, the user does enter password on the first request?
    – Alex Cohn
    Commented Mar 27, 2016 at 16:35
  • 1
    No, there is not passwords at all. The point is not the restricting access to the API. There is no API password. The only goal to guard a user's identity and do not let anybody impersonate a user who already did transactions with a specific id.
    – g.pickardou
    Commented Mar 27, 2016 at 16:44
  • OK, your intent is more clear now. Please see the update.
    – Alex Cohn
    Commented Mar 27, 2016 at 16:55
  • Many thanks. If the "disk" is not encrypted and the device is vanilla unbricked, can a 3rd party application search and access my app's stored id on the "disk"?
    – g.pickardou
    Commented Mar 27, 2016 at 17:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .