I am developing an android application which needs to communicate with a web server. Instead of using common SSL I would like to save my custom public key in resource folders of the application(APK installation file) so before starting sending or receiving data to the device, first server asks for a secret shared key from device which is encrypted via public key. Is man in the attack possible in this scenario?
Update: The method which I want to use is called "certificate pinning" and is common is some use cases. https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning