Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string from my phone to my computer. Since more people will have this problem, I'd like both the web application as the app to be available to everyone. That's why I will need to establish some kind of link between a session on the web application and an instance of the Android app. I thought of the following, inspired by Firefox Sync's system:
- User goes to the web app and gets a unique pin code NA which is linked to his session id
- User enters NA in the app and gets a new random pin code NB (the app sends NA to the server and receives NB)
- User enters NB in the web application
- The server verifies that the NB inputted in the web application is the nonce that was sent to the app that sent NA. I'm also thinking about checking that the web app and the app are using the same IP address, although this may give issues with cellular networks.
Both the app and the web app are uniquely identified by a session id which is sent together with every request.
After this authentication scheme, a link is established which is valid for so-long time. Of course also the nonces used in the scheme are kept track of by the server and have a deadline. Naturally, all communication (app - server, server - web app) is done over an encrypted channel.
Now, the app can send a string to the server, which then communicates it to the web app to which it is linked. The web app would not show the string of course, but merely copy it to the clipboard when the user asks for that. This reduces the risk of people looking over your shoulder.
Is this scheme secure? What I'm mainly worried/wondering about:
Session stealing: this would of course be more difficult when IP is checked as well, but still, it could occur. When using HTTPS, am I correct that the only way the session could be stolen would be using a man in the browser or man in the phone? This would be acceptable.
How do I choose a bit length for the nonces? It always occurred to me that Firefox uses incredibly short pin codes. Is the necessary bit length dependent on how many users the application would have (for example, with 10,000 open nonces at a time in the database, I could imagine the bit length would need to be greater than with 10 open nonces, to make brute force attacks harder).
Would using a web app on the phone as well (either making a sending and a receiving version of the web app, or making this two-way communication) introduce any additional security vulnerabilities (except for man in the browser on the phone)?
Things I didn't see, obviously.
Am I reinventing the wheel?
Note the requirement to not have to install anything on the computer; it should run in the browser. Also, I'd prefer to not have my passwords in the cloud as with LastPass. The strings that are communicated with my app would be deleted after the web app received them.