So, some background. I am currently working on a social media app for Android. We are programming it in Java, and are using OKHTTP3 for a connection to the PHP backend, which will handle updating MySQL Database and storage.
My question is this: How should I handle passwords? Once the user enters their credentials into the login form, do I hash the password (we plan on using bcrypt) and then send them over the PHP backend for immediate storage? Or does the PHP Backend need to do more security hashing or encryption?
The way I think it will be done right now is this: 1. User enters credentials for signup 2. Password is hashed 3. Credentials are sent to the server 4. Credentials are entered into MySQL - What should be done differently? Is this fine?
Reading making an iPhone/Android app which sends a user password to my server, how to secure? didn't answer my question well enough.