Secure android and server calls

Question

I plan on adding an authentication system on my android app using web services.

When my app calls the server using a POST call how can i secure the client can't find the URL and try to do his own posts and use this against my server?

Answer 1

You must use the secured HTTP connection i.e. HTTPS. I don't have working example but have a look at the classes under the package javax.net.ssl.*. Here I believe the server already supports it. If this is not the case then you have to get the server to supports it.

Answer 2

When my app calls the server using a POST call how can i secure the client can't find the URL and try to do his own posts and use this against my server?

You can use SSL/TLS to secure the connection. The URL endpoint will be encrypted. Clients can see that they are connecting to the host "domain.com", but do not know the actual path, e.g. "domain.com/secret.php"

Make sure to use mutual authentication. This is because your client device cannot be trusted. You would have to include a private key with your app which your server will verify through a challenge response. Without mutual authentication, a web proxy such as fiddler can be used to decrypt SSL.

You can use the android keystore to store the private key. Do note that if the phone is rooted, the private key can be retrieved. The link below states that root is prohibited from creating or listing keys. However, the su command allows a root user to switch to any other user, which can then list his own keys.

More info on using keystore to store the certificate: http://nelenkov.blogspot.sg/2012/05/storing-application-secrets-in-androids.html

In order to compromise your app, the attacker has to first root his phone, retrieve the private key, figure out the encryption algorithm, decrypt the communication and finally code a client that will simulate your app. This should provide a reasonable amount of security that should deter most casual attacks.