My aim is to have an (iOS) app in which the user would login, then on sucsessful login, gain access to additional information over an encrypted webservice (undecided).
From research, I understanding encryption techniques of diffie-hellman key exchange, and 'signatures' using HMAC with secret key (from the diffie-hellman).
Further research lead me to HTTPS to ensure no-eavesdropping.
However I'm now a little confused as to what I would need to do over the HTTPS connection to ensure that the login data is secured between app & server.
- Is HTTPS enough security to pass POST 'username' & 'password' data down the line to the server on its own? or would an additional security such as a hash of the password be needed?
- Would I need to implement a full key exchange + request signature (and at some point an Access Token), over an HTTPS connection?
I'm unsure where to draw the line with encrypting.