2

Im building an app which should receive data from my server. The Api should be a PHP based script which provides the data as JSON.
However I want to keep the data private and it should only be accessible by the app itself.
How can I prevent others from reengineering my app and find a way to access the API?
I thought about using a API key for the main access and SSL to prevent the data from being read while performing a man in the middle attack, but how can I hide the GET request itself or should I use some kind of PGP and encrypt the data itself?

3

The first thing you should do is to ensure that all communication between your app and the server uses HTTPS rather than HTTP. This should protect you from casual packet inspection. To make this setup more secure, you may also consider using certificate pinning to prevent any man-in-the middle attacks involving a forged certificate for your site.

If you are using SSL, the contents of the GET request will be encrypted (though the fact that you are making a connection to your server will be evident). Your real problem is that if you distribute the app to the general public, it can be reverse engineered and any API key you use can be extracted. You can obfuscate the binary, but this cannot totally eliminate the possibility of reverse engineering.

Depending on your app, and the nature of your data, you may want to worry more about authenticating the users of your app, rather than the application itself.

  • Okay do you think implentting OAuth with some combination of MAC/IMEI as username and password and limiting the API Calls would help? No personal data which would need extra protection will be send. It's just that I would like to prevent data extraction by bots or any third party apps using my data. – Kimmax Aug 24 '14 at 15:39
2

The key to security is understanding attack vectors. Who is trying to get access to your data?

It's a fundamental theorem that you can't ungive information. If a client has received data from your server, that can't be undone. Cryptography just makes sure that the right client receives information.

In particular, "the app itself" is not something which you fully control. The client is a computer somewhere on the Internet. Your application running on that computer can be studied by the owner of the computer. Data sent to the app resides in memory and can be studied after decryption. Encryption just protects the data against eavesdroppers / men-in-the-middle.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.