0

I want to make a mobile app that will act as a Credentials Manager and store all my access information for websites, credit cards, secure notes, and so on on the server encrypted with REST API.

The plan is the following for the client:

  • The mobile app will be the client.
  • AES/CBC/PKCS7Padding encryption, master password used for authentication.
  • SecretKey would be stored in Java Keystore, since it is an Android app.
  • The data would be sent encrypted to the API.

The API would work like this:

  • It will store all data that it gets from the client, encrypted.
  • HTTPS communication.

I would like to get some feedback on this approach or propose some other solutions.

Improve this question
9
  • 1
    So, you encrypt the data on the mobile client, and pass the encrypted data to a server for storage. That's all cool, but what problem is this supposed to solve? What threats are you trying to counter? Have you looked at other password manager apps to see how they do it? There's just not a lot to provide feedback on here. You are also missing a ton of functions that would be required. Like, authentication. – schroeder♦ Sep 22 '20 at 18:23
  • And this is looking a lot like your previous question: security.stackexchange.com/questions/238591/… – schroeder♦ Sep 22 '20 at 18:25
  • Yes, I am investigating and trying to find the solution. I am missing part about authentication, since I wanted to first to get my head around encryption part. Do you have some suggestions or you see that I miss something? – Zookey Sep 22 '20 at 18:36
  • 1
    How will the user recover their data if they lose their master password? What happens if the encryption key is stolen? What do you mean by "Master password is used for authentication?" – Conor Mancone Sep 22 '20 at 18:40
  • I would recommend you to check out OWASP's Application Security Verification Standard. – Saustin Sep 22 '20 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.