I'm currently developing an android bank client app. Obviously security is key here. The app sends requests over HTTPS TLSv1.2 to my java server.
What I currently have in mind
The app asks for user's username and password and sends these in plain text over HTTPS TLSv1.2
The password is hashed with bcrypt and if credentials match, an access and refresh token is generated. The refresh token is stored in the database along with the user's UUID. The access token and refresh token is then sent back to the app. The app stores these tokens in
SharedPreferences(PRIVATE_MODE) The user is supposed to not have to re-enter their credentials if the app is opened again later and the refresh token is still non-expired.
After successfully logging in, a
PinCodeActivity is started which asks for the user's 5-digit pin code. The
PinCodeActivity is always started when the app is opened and the user is still logged in. The entered pincode is also sent to the server in plain text. The pincode is then hashed and matched with the pincode in the database for the user corresponding with the access token which is also sent in this request to authenticate the pincode. If it matches, the server sends an OK response and the pincode is stored in memory on the app to be sent alongside every request to the server. When the app is closed this pincode is removed from memory.
What I'm not sure about
If the credentials and pincode is sent in plain text, could they not be intercepted by a Man In The Middle Attack? If so, if I would hash them on the app, would this not have the exact same implications? In that case an attacker could just send the intercepted hashes and login/attack with those hashes. I'm really no where near a security expert so please let me know if I got anything wrong or if there's something I should know.
Basically what I want to know is if the implementation I proposed is a secure method for a bank client app. And if not, how could I make this more secure?