Other User identification and then?

[LucaMs]

Whether I use my method or Facebook or Google Plus or other methods to identify and authorize a user, my app will receive an authorization. A hacker could easily change this part and impersonate any other user.

What can be done?

 

[KMatle]

Any app can be changed/hacked at the point where you check if the user is authorized (f.e. by changing a some values).

If your app runs without needing external data: No Chance

If your app is based on sending/receiving data you can control it via an external Server (php/MySQL -> Login -> data from known users only)

 

[LucaMs]

Yes, it is a B4J web server - B4A client.

But, currently, the app receives permission from the server, after sending username and password and since then the data sent by the client are authorized.
If the hacker discovers the place where the authorization is received, he has solved.

However, thinking about it, the place at which the app receives the authorization is a routine called by the server, then it is triggered by an event, so maybe it is less detectable.


However, if someone has an optimal solution ...

 

[Erel]

Check this tutorial: https://www.b4x.com/android/forum/threads/server-login-system-filters-tutorial.39020/#content

 

[LucaMs]

Check this tutorial: https://www.b4x.com/android/forum/threads/server-login-system-filters-tutorial.39020/#content

Thank you, I will read it avidly

 

[LucaMs]

Check this tutorial: https://www.b4x.com/android/forum/threads/server-login-system-filters-tutorial.39020/#content

I read it but I don't know how it can do for me.

I have a "non UI" B4J server, which manages the client-server communication via a websocket handler class.
Those filters, if I understand correctly, limit access to certain folders.

 

[lemonisdead]

Hello,
If I understand you correctly : you want to authenticate and after that be sure the exchanges are provided by authenticated devices only.
They are several ways to achieve that :
- a token or cookie set when the device was authenticated
- a "special" key shared between the device and the server and added to parameters
- a crypted object instead of parameters encoded with a temporary key
- you can even store a comibation of IP, ID on the server and check the conformity before executing any command.

I don't know what you are wanting to create so my personal advice (not a general recommendation) is to ask you not to be shy and let your genius mind imagine your own solution . We have all the tools in b4x to create a dedicated identification process.

And you could do" belt and strap" in a SSL secured environment.

 

[LucaMs]

let your genius mind

Ehi, you are "talking" with me. I'm sure you have the wrong person


What I mean, "exactly", is:

an user tries to connect using a nick name of another user and a wrong (of course) password.
///
Well, trying to explain better, I have found the solution.
I would have continued writing:

The server sends an answer, like: "Authorized" or "not authorized" (or a single byte, it's the same).
If a hacker could find this place, he could modify the next code, which should be something like:
If ServerMsg = "Authorized" Then...

but if I use two different routines: Sub Authorized and Sub NotAuthorized (obfuscated) he could not act in that way.
Uhm... Well, he could authenticate regularly, find out the location of the routine and then use a different nick and...!


Thank you, Lemon

 

[Erel]

How can a hacker modify the server code?

 

[LucaMs]

How can a hacker modify the server code?

I was talking about the app, of course; but, of course, I should write in Italian

 

[LucaMs]

Ehi, you are "talking" with me. I'm sure you have the wrong person


What I mean, "exactly", is:

an user tries to connect using a nick name of another user and a wrong (of course) password.
///
Well, trying to explain better, I have found the solution.
I would have continued writing:

The server sends an answer, like: "Authorized" or "not authorized" (or a single byte, it's the same).
If a hacker could find this place, he could modify the next code, which should be something like:
If ServerMsg = "Authorized" Then...

but if I use two different routines: Sub Authorized and Sub NotAuthorized (obfuscated) he could not act in that way.
Uhm... Well, he could authenticate regularly, find out the location of the routine and then use a different nick and...!


Thank you, Lemon

 

[lemonisdead]

Luca,
That scenario can only exist if you don't store (on the server) a way to identify the authenticated devices.

Let's admit that the code is used to "unlock" a trial app. If you check regularly if the device is allowed to run the app (let's say based on a time schedule), you would be able to lock the app again and again.
And if it is used to exchange informations between the devices and the server, check if the device is authorized each time you have to do something on the server (opening a socket, maintaining a list of opened socket, etc).

 

[LucaMs]

[text ready; now I read the post above ]


Perhaps I have found a better way.

The hacker knows the name of the user as these is a game player of my app; if I require the user of the app:
UserName (not visible)
PlayerName (visible)
PW

he may not try to impersonate someone else.

 

[LucaMs]

That scenario can only exist if you don't store (on the server) a way to identify the authenticated devices.

Yes, but use a device ID is a limitation, in my case, also because the app will be free with advertising.

Thank you

 

[KMatle]

Yep. Let the user do a Login login (at least one time and store a file with a generated string like a Serial number on the device). At every start send it to the server with the username and compare it with the data stored in a db. Every n-th time update it. Easy.

I use at least a length of 50 Bytes. Renew it once a week or so.

Even if someone hacks it, he needs to have a valid Keyfile. If he copies it from another device, it's not valid AND he doesn't know the email adress (username) of the registered user. Even if he uses his own (pay once, copy it) you can check the ip address (more than one at a time will not work).

 

[LucaMs]

If he copies it from another device,

I don't need to protect the app (copy it, I will earn more ), just the user identity (you cannot play using my nick name).

Thank you (Klaus? )

 

[KMatle]

Klaus

Yep, but the small one from Germany not the Swiss one

copy it, I will earn more

Best protection