1

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing transaction information for specific accounts. This id/key for specific accounts is dynamically decided based on what's going on with the client and what account needs accessing within code on client side. However since all information for the app is accessed through an api over HTTP(S), the id/key could potentially be publicly available to individuals with ill intentions..

I'm extremely paranoid of security breaches of this information, but need to find a way to get it down to the client securely without the possibility of interception.

I've thought of a few ways, but I haven't come up with anything that seems full-proof, and I'm not sure that there is anything guaranteed since even an encrypted value of this id/key pair can be acquired with API credentials.

My main idea was some sort of client / server dynamic authentication that's uniquely generated and identifiable between both entities, along with a salted 2 way encryption of this id/key that is passed back to the client? Although this could be breached if someone managed to dig into the compiled code and see how this authentication / dynamic salt is generated.

Obviously, it's 100% better to not have to transmit this information down to the client, but unfortunately in this specific situation there's no way around it.

Given the sensitivity of this information, the solution here needs to be solid.

  • 2
    Your question is ambiguous, will you be using TLS or not? You mention HTTP in your title and HTTPS in your question. What are the primary attack vectors you're concerned about? From your post it seems like MITM is your primary concern, however this can be addressed with TLS using certificate pinning. – thexacre Sep 6 '14 at 9:35
1

It should be possible for you to get the key down to the client without risk that an attacker with access to the network connection can intercept it. That could be down with something like SSL using specific server and client certificates to authenticate each end of the connection.

However an attacker with access to the client code (e.g. most mobile platforms) will always be able (in theory) to get access to any secret you hold on the client be that the client certificate in use or the key itself, and really you should plan your security model with that thought in mind.

Once something is placed on a system that you have no control over you have to assume that an attacker who has control over that system has access to it.

  • Interesting. So in this situation is it really a matter of how difficult the process to get the credentials for accessing the sensitive information would be? Rather than IF they can get the credentials? Would it be possible for them to intercept a request coming from their client and get the certificate information used for authentication? – Braydon Batungbacal Jul 8 '14 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.