Android Question Restrict access to m app only

tufanv · Mar 3, 2017

Hello,

My app is using a HTTP POST method to receive some information from mysql database via php file. According to suggestions in the past topics, I store the url in proccess_globals and obfuscate it also using https to hide the full url in case of sniffing.

My question is , lets say someone found the URL. Can you suggest a way to check in the php or someother place that if only the request maker is my app give respond else do not .

I think of sending the package name of app for example with the httpjob also but i is not a solution as anybody can send my package name with the request.

I would be happy to hear suggestions.

Thanks.

KMatle · Mar 4, 2017

To protect a webservice it's a good option to use

- a login (userid/mail & pw) = every user of your app has to sign on
- strong encryption methods
- additionally parameters like IMEI (if available) or other keys to check if the caller is authorized
- two factor authorization (like login AND additionally send a code to the registered mail address
- tan lists (list is generated when the customer creates an account) which can be stored on the device as a ADDITIONAL check when you need a automatic solution
- check multiple logins (via IP and login tries, block ip's and or users -> send a mail that the user is blocked and some action is needed to activate the accoutn again)

URL:

Use (at least) two URL's:

- one for the login (which is included in the app's code)
- the others are coming from the server after login and are kept in memory

It's all about to store "nothing" in your app and retrieve "everything" from your server

tufanv · Mar 14, 2017

KMatle said:
To protect a webservice it's a good option to use

- a login (userid/mail & pw) = every user of your app has to sign on
- strong encryption methods
- additionally parameters like IMEI (if available) or other keys to check if the caller is authorized
- two factor authorization (like login AND additionally send a code to the registered mail address
- tan lists (list is generated when the customer creates an account) which can be stored on the device as a ADDITIONAL check when you need a automatic solution
- check multiple logins (via IP and login tries, block ip's and or users -> send a mail that the user is blocked and some action is needed to activate the accoutn again)

URL:

Use (at least) two URL's:

- one for the login (which is included in the app's code)
- the others are coming from the server after login and are kept in memory

It's all about to store "nothing" in your app and retrieve "everything" from your server

Hello,

Thanks for answer but membership is not an option. This is a live finance app which shos latest currency data. Nobody registers for these services.
Anyone with the link to my php can retrieve latest data and use it for their own app. There must be another way obviosuly but i can't think any other.

Erel · Mar 14, 2017

There is no simple solution for this.

You can add some protection by adding a parameter that changes every day and is calculated by your program.

tufanv · Mar 14, 2017

Erel said:
There is no simple solution for this.

You can add some protection by adding a parameter that changes every day and is calculated by your program.

A friend of mine working in an app development company says that , you have to buy a ssl for your website,and create a certificate for your mobile app and embed it in your mobile app. Later if you just authorize that certificate, only the app with the certificate can pull the data.

I don't have any idea about these but if this is possible i will search the internet about it ?

Erel · Mar 14, 2017

I don't think that it will add any real security. Someone could extract the client certificate and use it in his app.

Relevant discussion: https://security.stackexchange.com/questions/63462/using-client-certificate-to-authenticate-an-app

sorex · Mar 14, 2017

the problem with certificates is that is costs a lot for what it is and you are bound to periods so you'll need your users to install a new certifice every year or so.

Jmu5667 · Mar 14, 2017

Maybe consider generating a daily key, let your app request the key from your HTTP service before the actual post, then make you HTTP post request with the key the app obtained. When the server receives the key, you can validate it server side and either process the HTTP request for deny it.

tufanv · Mar 14, 2017

Jmu5667 said:
Maybe consider generating a daily key, let your app request the key from your HTTP service before the actual post, then make you HTTP post request with the key the app obtained. When the server receives the key, you can validate it server side and either process the HTTP request for deny it.

any app can request the key from http service , this is the problem. :/

Jmu5667 · Mar 14, 2017

Fair point. Consider this.

1. App generates a pin code, 6 digits. The pin code is based on the current time.
2. You send the pin code in, allow 30 sec variation on the pin code.
3. If the pin code is within range allow the request to be process.
4. You can design your algorithm to generate the pin code, app name, imei etc.

Erel · Mar 14, 2017

A real protection can be achieved with FirebaseAuth + server side verification: https://www.b4x.com/android/forum/t...rification-for-signed-in-users.68672/#content

This means however that users will need to sign in.

tufanv · Mar 14, 2017

Erel said:
A real protection can be achieved with FirebaseAuth + server side verification: https://www.b4x.com/android/forum/t...rification-for-signed-in-users.68672/#content

This means however that users will need to sign in.

Yes, that is a true protection but needs user registration as you said. I will think about some simple solutions to at least make it harder. Thanks for all suggestions .

Robert Valentino · Mar 15, 2017

Would something like Random Symmetric Keys work for this:
http://crypto.stackexchange.com/que...k-like-data-sharing-data-via-untrusted-server

https://www.gnupg.org/gph/en/manual/x110.html

Android Question Restrict access to m app only

tufanv

Expert

KMatle

Expert

tufanv

Expert

Erel

B4X founder

tufanv

Expert

Erel

B4X founder

sorex

Expert

Jmu5667

Well-Known Member

tufanv

Expert

Jmu5667

Well-Known Member

Erel

B4X founder

tufanv

Expert

Robert Valentino

Well-Known Member

Similar Threads

Android Question Restrict access to m app only

Expert

Expert

Expert

B4X founder

Expert

B4X founder

Expert

Well-Known Member

Expert

Well-Known Member

B4X founder

Expert

Well-Known Member

Similar Threads

Privacy & Transparency

Privacy & Transparency