I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing transaction information for specific accounts. This id/key for specific accounts is dynamically decided based on what's going on with the client and what account needs accessing within code on client side. However since all information for the app is accessed through an api over HTTP(S), the id/key could potentially be publicly available to individuals with ill intentions..
I'm extremely paranoid of security breaches of this information, but need to find a way to get it down to the client securely without the possibility of interception.
I've thought of a few ways, but I haven't come up with anything that seems full-proof, and I'm not sure that there is anything guaranteed since even an encrypted value of this id/key pair can be acquired with API credentials.
My main idea was some sort of client / server dynamic authentication that's uniquely generated and identifiable between both entities, along with a salted 2 way encryption of this id/key that is passed back to the client? Although this could be breached if someone managed to dig into the compiled code and see how this authentication / dynamic salt is generated.
Obviously, it's 100% better to not have to transmit this information down to the client, but unfortunately in this specific situation there's no way around it.
Given the sensitivity of this information, the solution here needs to be solid.