I am currently working on a RESTful webservice with Java that is used by mobile devices, namely Android and iOS, using a framework that allows me to abstract from both. I'm adding this information because it means that I am slightly limited when it comes to the use of frameworks that might help with security.
What I am currently doing is the following:
The client has the password stored in plaintext in an app-internal file. That's because I need to send the username+password with each request --> RESTful. It is transmitted via the HTTP authorization header as username:password Base64 encoded. The transmission is done via HTTPS. The server decodes username+password and computes a hash from the password which he then checks with a hash for that user in the database. I have taken the hashing algorithm and code from here and here.
My assumptions:
- If I assume that the client itself has not been compromised, this should be secure.
- If someone gains access to the server's database, the users should still be safe because the passwords are hashed.
- I can transmit the passwords to the server in plaintext (Base64), because the transmission itself is secured via HTTPS.
I'm only working on this project in my spare time, which means I don't want to spend too much time on security alone and since it's just a game, hijacking an account wouldn't be that critical as well. However, I would still like to have a robust authentication mechanism.
My questions:
- Are my assumptions correct?
- How would it be possible to compromise my current approach?
- What could I do to further improve security?