3

I'm building an mobile app that needs to communicate with a web service. To make sure that only my app is communicating with the web service, I authenticate using OAuth 2. The fact that I need to store a client id + secret in the app binary is unfortunate enough, but to retrieve an access token using OAuth 2 I need to send a client id and client secret to the server. Is it not very easy to:

  • Fake an SSL cert and add it to the list a mobile device's trusted certificates
  • Pretend to be the server and monitor the incoming requests

The request will contain the client id and client secret. Now I use these in some other app and communicate with my server.

Am I missing or not understanding something? Would I be better off using OAuth 1?

Improve this question
1
  • So don't fake a SSL Certificate, purchase one, and use a real one. Otherwise all you are doing is putting fake security on something that is easy to work around, in other words, you are then now transmitting secret information in the clear. – Ramhound Oct 28 '12 at 13:21
4

If you are distributing your "secret" to the world with your application then its not longer a secret. It is not possible to prevent an attacker from communicating to your web service.

You can never trust the client in a client/server architecture.

Improve this answer
1
  • So what you and @VitalyOsipov are saying is the fact that the id+secret are kept in the binary is already much worse. This seems to be pretty much the de facto standard though... any library that uses oauth 2 that I've used does this. As the client is in the user's hands I suppose the best I can do is not allow the client to do anything harmful in the first place. Thanks for your answers. – Erik Oct 29 '12 at 7:18
0

It is very difficult to impossible to impersonate the server. As you notice yourself, the only real exposure there is that someone can lift the secrets out of your binary, not intercept them on the wire.

There is also a slight chance that someone is MITM-ing your communications if you are on a completely untrusted network, e.g. on wireless in a coffee shop.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.