Android Question Restrict access to m app only

[tufanv]

Hello,

My app is using a HTTP POST method to receive some information from mysql database via php file. According to suggestions in the past topics, I store the url in proccess_globals and obfuscate it also using https to hide the full url in case of sniffing.

My question is , lets say someone found the URL. Can you suggest a way to check in the php or someother place that if only the request maker is my app give respond else do not .

I think of sending the package name of app for example with the httpjob also but i is not a solution as anybody can send my package name with the request.

I would be happy to hear suggestions.

Thanks.

 

[KMatle]

To protect a webservice it's a good option to use

- a login (userid/mail & pw) = every user of your app has to sign on
- strong encryption methods
- additionally parameters like IMEI (if available) or other keys to check if the caller is authorized
- two factor authorization (like login AND additionally send a code to the registered mail address
- tan lists (list is generated when the customer creates an account) which can be stored on the device as a ADDITIONAL check when you need a automatic solution
- check multiple logins (via IP and login tries, block ip's and or users -> send a mail that the user is blocked and some action is needed to activate the accoutn again)

URL:

Use (at least) two URL's:

- one for the login (which is included in the app's code)
- the others are coming from the server after login and are kept in memory

It's all about to store "nothing" in your app and retrieve "everything" from your server

 

[tufanv]

To protect a webservice it's a good option to use

- a login (userid/mail & pw) = every user of your app has to sign on
- strong encryption methods
- additionally parameters like IMEI (if available) or other keys to check if the caller is authorized
- two factor authorization (like login AND additionally send a code to the registered mail address
- tan lists (list is generated when the customer creates an account) which can be stored on the device as a ADDITIONAL check when you need a automatic solution
- check multiple logins (via IP and login tries, block ip's and or users -> send a mail that the user is blocked and some action is needed to activate the accoutn again)

URL:

Use (at least) two URL's:

- one for the login (which is included in the app's code)
- the others are coming from the server after login and are kept in memory

It's all about to store "nothing" in your app and retrieve "everything" from your server

Hello,

Thanks for answer but membership is not an option. This is a live finance app which shos latest currency data. Nobody registers for these services.
Anyone with the link to my php can retrieve latest data and use it for their own app. There must be another way obviosuly but i can't think any other.

 

[Erel]

There is no simple solution for this.

You can add some protection by adding a parameter that changes every day and is calculated by your program.

 

[tufanv]

There is no simple solution for this.

You can add some protection by adding a parameter that changes every day and is calculated by your program.

A friend of mine working in an app development company says that , you have to buy a ssl for your website,and create a certificate for your mobile app and embed it in your mobile app. Later if you just authorize that certificate, only the app with the certificate can pull the data.

I don't have any idea about these but if this is possible i will search the internet about it ?

 

[Erel]

I don't think that it will add any real security. Someone could extract the client certificate and use it in his app.

Relevant discussion: https://security.stackexchange.com/questions/63462/using-client-certificate-to-authenticate-an-app

 

[sorex]

the problem with certificates is that is costs a lot for what it is and you are bound to periods so you'll need your users to install a new certifice every year or so.

 

[Jmu5667]

Maybe consider generating a daily key, let your app request the key from your HTTP service before the actual post, then make you HTTP post request with the key the app obtained. When the server receives the key, you can validate it server side and either process the HTTP request for deny it.

 

[tufanv]

Maybe consider generating a daily key, let your app request the key from your HTTP service before the actual post, then make you HTTP post request with the key the app obtained. When the server receives the key, you can validate it server side and either process the HTTP request for deny it.

any app can request the key from http service , this is the problem. :/

 

[Jmu5667]

Fair point. Consider this.

1. App generates a pin code, 6 digits. The pin code is based on the current time.
2. You send the pin code in, allow 30 sec variation on the pin code.
3. If the pin code is within range allow the request to be process.
4. You can design your algorithm to generate the pin code, app name, imei etc.

 

[Erel]

A real protection can be achieved with FirebaseAuth + server side verification: https://www.b4x.com/android/forum/t...rification-for-signed-in-users.68672/#content

This means however that users will need to sign in.

 

[tufanv]

A real protection can be achieved with FirebaseAuth + server side verification: https://www.b4x.com/android/forum/t...rification-for-signed-in-users.68672/#content

This means however that users will need to sign in.

Yes, that is a true protection but needs user registration as you said. I will think about some simple solutions to at least make it harder. Thanks for all suggestions .

 

[Robert Valentino]

Would something like Random Symmetric Keys work for this:
http://crypto.stackexchange.com/que...k-like-data-sharing-data-via-untrusted-server

https://www.gnupg.org/gph/en/manual/x110.html