4

My intention is to transfer files between a computer and a cell phone in the same network. I have created a system consisting of two apps for this purpose (everyone should be able to use the apps): The one on the computer creates a Python http server that can receive and send files. The mobile app can then send simple http requests to this server, the body of which contains the files, for example.

However, this is not yet secure - everyone in every network should be able to securely transfer their files.

Would it be enough to use HTTPS with the help of a self-signed SSL certificate that is generated each time the app is started? Or would it still be possible for attackers to read the data? How the mobile app gets the key/certificate is irrelevant for now.

1

2 Answers 2

10

For security, you need authentication. If Alice wants to sends a file to Bob's computer, Alice's app needs a way to verify that it's Bob's computer it's talking to, and not an attacker's computer. So either you need a certificate authority, or you need to share some data out-of-band.

For example, with self-signed certificates you could show the public key of the certificate on both Alice's phone and Bob's computer, and ask them to verify whether they are the same.

Another way to provide security is for Alice and Bob to agree on a password or key (in real life, not through the app), and configure it in the app.

Without an authentication step, you can encrypt things but it will be possible for an active man-in-the-middle attacker to pretend to be Bob.

4

I think the appropriate answer to this would largely depend on your threat model how much effort you want to go to to make this system secure. (E.g. how much would you care if it was compromised or the data was stolen?)

But as a brief overview, self signed SSL certificates is a good approach, but not as secure as certificates issued by a Certificate Authority. This is because you then need a way to make sure the mobile app cam trust the certificate in question.

But one to go about this is pre-loading the certificate before the app ‘starts.’ Then this way it can be verified. And then use this certificate to configure an HTTPS server.

But there are also disadvantages of pre-loading certificates, for example if a new one is needed (like if it gets stolen or intercepted), a whole new app version needs to be released, unfortunately. And this is just one- there are many.

But for something as simple as what you want, and since your threat model doesn’t seem too high, I personally would just go for pre organised ss SSL certificates with HTTPS, but thats just me.

4
  • Preloading certificates doesn't work. Since you're going to need to ship a complete keypair in order to both encrypt and decrypt, any sufficiently motivated attacker can extract that keypair from a public version of the app. My suggestion is to keep self-signed device-specific certificates, but introduce an out-of-band verification mechanism, like scanning a QR code or visually matching a derived keyphrase. This is what most secure messengers do today. Alternatively, use an account to authenticate individual app instances, and cross-sign their self-signed key with a centralised service.
    – detuur
    Commented Jun 25 at 10:38
  • @detuur yes, but the OP doesn’t phrase their question like they are making “a public” app, but more of a personal experiment- and plus- a real app would definitely use a reliable CA. Commented Jun 25 at 11:11
  • And their threat model doesn’t seem too advanced- because if it was- they would use a CA. Commented Jun 25 at 11:11
  • @security_paranoid The problem is if I distribute the application I need for every user or even transfer a different ssl certificate. Because otherwise one could just look for the certificate in the application and then encrypt other users transfers in e.g. a public wifi. So a certificate authority for every certificate would be more difficult. And I don't really see how this would prevent attackers. Commented Jun 26 at 16:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .