I'm building an android banking app:
Part I
So while the user is signing in he would need to provide his email and password in a form inside the app. Okay, so we can encrypt the password by using RSA and we would send the encrypted message (Let this message be called E)
to the server(In my case a php), that would decrypt the data and compare the hashed password... And the server would know the password is correct.
1) Can't a hacker monitoring the data transferred between the user's phone and a wifi be able to know E
? So wouldn't he be able to send E
to the server and fake being the user signing in?
Part II
Now the server would reply to client, after verification of password, and send him some private data, for example his balance(or private transactions).
case a: We don't encrypt the private data, the hacker here would obviously be able to see the private data(which are supposed to be private).
case b: We encrypt the data, using public secret key encryption, so the private key would be inside the app.
2) But wouldn't the private key in this case(case b) be actually "not private" as a hacker could decrypt my apk file and see the private key? What is the solution?
3) In case b, is the method of encryption(RSA) wrong? Is there a better method?