-2

When securing a website SSL/TSL is the only way, because browsers need to support it.

However, when creating a native application that needs to communicate with a remote server, this does not seem to be a requirement, so I am looking for some good alternatives.

The main reasons why someone might want to do this:

  • More control over certificates/rejections
  • Not having to deal with CA's
  • Making it harder to intercept traffic locally

Creating a custom encryption is not recommended so, what are some verified alternatives to SSL for Android and iOS apps?

  • 1
    If you generate a self signed certificate, you don't have to deal with a CA. Don't you think? Also, can you elaborate on what more control do you want over certificates/rejections? – Limit Feb 5 '17 at 15:12
  • 2
    Like @Limit said, it appears that your requirements can be met within TLS. Why are you looking for alternatives to TLS, as compared to ways to achieve your objectives within TLS, which for all its faults is pretty heavily vetted simply because it is so widely used. – a CVn Feb 5 '17 at 15:25
  • 1
    What security guarantees do you need this system to provide? What attacks are you interested in defending against (and which aren't you)? – Xiong Chiamiov Feb 5 '17 at 15:39
4

By using a self-signed certificate and enforcing the use of this certificate in your application (i.e. certificate or pubkey pinning) you are independent from any CA and have full control over the life time of the certificate. The traffic is also resistant against SSL interception since the man in the middle would need to use a certificate which you accept, i.e would need to have exactly the certificate you use in your server and also the public key. This is impossible unless the key got leaked or the server hacked (i.e. your fault).

If you use a pinned self-signed certificate with TLS you also profit from a proven technology which is available on most systems and for most programming languages so no need to look for alternatives.

Making it harder to intercept traffic locally

Note that TLS and similar technologies only protect against interception on the network. It does not protect against local interception on the device which can be done by hacking the application itself to intercept the traffic before encryption. Such protection can only be done if the application itself is protected against modification by the user, which is practically impossible as long as the user has full control of the device (i.e. can root it, can modify software).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.