I'm not a security expert but I want to ask about tradeoffs in a web service API I'm designing for mobile apps.
It is an API which tracks users' locations so yes, the data is reasonably sensitive. However, it will be used by mobile applications, so I believe most of the time it will run on networks which are less prone to eavesdropping.
The app will keep user credentials (login and password) encrypted in a local database. I'm not sure which encryption scheme to use though.
The API will be accessed over HTTPS.
I'm considering either a long duration multi-use token or short duration one-time tokens. The shorter (length) the better, in order to reduce bandwidth usage. However, I'm not aware of how a token should be properly generated, in case some ten or more random bytes is not enough.
I'm asking about tradeoffs so I'd like advice on how safe is this strategy in the majority of cases i.e. in situations which are more likely to happen. However if you feel I'm overlooking the risks feel free to emphasize it and suggest alternatives (though I'd be curious about how far I could get with the tradeoffs if the data was less sensitive).