CODEWITHSUNDEEP
androidsecurityauthentication
Benjamin Schwalb
Benjamin Schwalb

Reputation: 1134

User Authentification on Android - Security Implementation

I've been mostly creating smaller apps and games for Android so far, but am now creating a somewhat big app with lots of users and more sensible data than a highscore.

My normal approach was to just have a table for all users with passwords, authenticate with a simple Login Screen using a HTTP(S) call and that's it.

There's a few things I want to improve for this app though:

Secure Transmission

If I want to encrypt the user's password, where do I need to do it? On the device, before it's even sent? (In case of unsecure networks, like a public WiFi hotspot) Or better on the server, before writing it into the DB? Or should I just use SQL's encryption?

Auto Login

I want users to be able to stay logged in until the log out - how would I best do that? Not just security-wise, but also for the user experience.

My research shows me that using the AccountManager would be best to save the username and password and authenticate automatically when the app is started. Is there anything more to it, any security risks I'm missing here?

Access control

Usually, I would just expect every call made by an app to be valid, since a user can't access anything but the login screen without logging in. But how do I best authenticate a user's request to make sure that it's not an attacker? I can't just send the username/id with every request, so I probably need like a session token that I generate on each login? Or is there a better method?

Is there anything else I've forgot to think about?

Upvotes: 3

Views: 136

Answers (1)

Vitaly Kulikov
Vitaly Kulikov

Reputation: 723

I would suggest you to transfer password without encrypting it but by https. Other way would be to implement asymmetric encryption in your app and encrypt password with public key which you will receive from server.

On the server side I would hash password using some hashing algorithm with salt. And store only hash and salt. When users will log in, you can hash incoming passwords the same way and check hashes on equality.

To make auto login, you need to sign all requests from authorized users with a token. Token you will receive from the server after successful login. This token could be stored in Keystore, or special storage which is accessible only for this application.

Signing could be implemented by attaching to request additional parameter with checksum from all request parameters and token.

Additionally I would suggest you to think about unauthorized clone apps, which could pretend to be your app and call your server side API.

Upvotes: 1

Related Questions