0

I'm new to data-encryption and do not understand the following:

  1. I convert my domain into a "https" domain, by means of something like "Lets Encrypt".
  2. I have an android app that talks to an api on my domain.
  3. Do I still need to perform client side encryption using a public key on the android app -> send the encrypted data to my api -> decrypt it on the server using my private key? What does it mean if my domain is already https? Do I need to distribute public keys to every user who visits my domain? How do I do that?

migrated from stackoverflow.com Aug 18 '17 at 7:53

This question came from our site for professional and enthusiast programmers.

  • you don't need to client encrypt, but E2E is nice for some applications – dandavis Aug 19 '17 at 12:01
2

No, the whole point of TLS is to encrypt the traffic between your app and your server. TLS deals with the key distribution, which would otherwise be a really hard problem. TLS was made exactly to solve your problem. Adding another encryption layer that is essentially the same as TLS does not add any security for your system. It only increases complexity (attack surface).

Make sure your TLS implementation is secure and users cannot bypass it (using legacy HTTP or something). Consider using modern security features like strict transport policy and focus on web security (XSS, CSRF, etc.). Experience shows that most of the time the implementations are insecure, not the crypto.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.