I'm currently in internship in a software/app development company, where I have to come up with an idea about how can we handle the fact that the user will mostly use an app offline.
Basically, the app is a flight log, the first screen is a list of aircrafts. Once you click on an aircraft, you can then see the list of all flights belonging to this aircraft. The user will then be able to see every info on the flight, if there is a piece to change, anything unnatural etc...
I'm totally new to the security field of mobile apps (and I have only a bit of knowledge of security in general), so I've been reading a few questions/articles about this subject, but there is still some things I don't understand or I'm not sure about.
We're using CouchDB/PouchDB for the database, and I know that Bcrypt is used on the server-side (and the question left unanswered is: should we use it in client-side?)
So far I've came up with this idea:
The user comes to his office on the morning, connects to the app online, and his password is then hashed and stored on the server.
The user replicates his part* of the DB on the phone/tablet, along with his hashed password (+salt). the DB is encrypted with crypto-pouch
- The user can now logout and go on the field, where he has no internet connection.
- The user can login offline, access and modify his DB as he needs to for his work.
The user goes back to his office (or anywhere he has internet connection) and synchronises his tablet DB to the server one.
- : I'm saying "his part of the DB" because a specific user will only be able to work on a certain amount of aircraft/flights.
So here are my questions:
- Should I use two passwords? i.e one for online login on the server, and one for offline login? If so, what would be the strategy to adopt?
- Where should I store the hashed password on the tablet? I'm hesitating between the local DB or the SessionStorage, but if I understood it well, if it's stored on the SessionStorage and the user logs out while offline, it would be deleted and therefore the user wouldn't be able to login again right?
- Should I use Bcrypt on the client-side aswell and what does it imply?
- Is the use of pepper really relevant? I can't seem to know if the added security would be worth the implementation.
- Globally, is this approach a good one for this kind of situation? If not, why and what should I change?
- I've read a few things about token, but as I understand it, it expires after a certain time, and right now I've not been told anything about how much time would the tablet be offline before getting back online, so I don't think it's the best option, am I right?
I previsouly posted this question on software engineering, but I've been told it would be better here.
Also, I have to protect the data in such case that the user is offline, logged out, and someone has managed to get physical access to the device.
Don't hesitate to tell me if you need more information, I may have forgotten something.
Any help would be greatly appreciated!