Secure Communication Between .Net Application and Website

Question

Recently, We developed an application that we want it's users to pay for a monthly subscription in order to use it. So the first thing that came to our minds how to implement a secure way for our application to check for the User validity and those ideas came up

1. Using WebClient to enter to our website and log in using the user provided credentials : However, this might be vulnerable to MITM attack.
2. Using the first approach but using SSL certificate (to make sure that we are connecting to our server and not the attackers') : However, Fiddler can easily do a MITM attack and de-crypt the SSL communication, which will result in the same vulnerability as the first approach.

Due to the internet's lack of documentation of what we need, we had to ask here for someone to explain how could we make sure that:

1. Our application only connects to our server and not any fake hosted server (by the attacker).
2. The communication is secure. Not altered or edited some how in order to grant unfair access to our application. (by sending a fake response to the app or editing the original response before the application receives it (replay attack)).

Answer 1

You can't prevent a sophisticated user from cracking the application. The only thing you can do is make your security measures hard to circumvent. From what I understand your application provides all functions unless your server says "don't". You have several ways to achieve this

Plaintext: Easy to circumvent. Edit the hosts-file, write a pseudo-server, done.

Encrypted transport: Slightly harder to circumvent. Add a Root-CA certificate, write a pseudo-server, done.

Encrypted message: The application generates an encrypted request, the server answers with an encrypted response. Hard to circumvent on network level. You would have to extract the key from the application (which can be obfuscated in the code). You should use nonces here to prevent replay attacks.

Always possible: Find the instruction that says yes/no inside the application, patch it to always say yes, done :-)