I currently have a desktop application which requires the user to have a username and a password. These credentials are stored on a webserver (myserver.com), so when he types the username and the password and clicks on the Login button, they're sent to the webserver. If the credentials are right, the server will return "ok", some user info, and the main form will be displayed. If not, the server will return "wrong" and an alert will be displayed. However, this is very insecure, because a user can just edit the hosts file, redirect myserver.com to his localhost, which always returns "ok", and bypass the login screen. I was told to generate a pair of RSA keys, and then encrypt a "nonce" (a random number) in the desktop app and send it along with the credentials. If the server could return the number decrypted, that would mean that it's actually my server. I have to say that the webserver is hosted in Heroku so HTTPS is enabled by default, but I don't have any SSL certificates whatsoever. This seems to be pretty good, but is this prone to a man-in-the-middle attack? An attacker could just redirect myserver.com to his localhost, send the request from localhost, receive the decrypted number, change "wrong" to "ok" (or change some user info) and send it back to the app.
How can I make a more secure login form for a desktop app?