what kind of security should be used while creating apps like facebook in Android and IOS

Question

I am going to create a Social media Application similar to facebook for both Android and IOS.I have login form where user need to give their uname and password.My server Team is handling webservices.

---

• how to protect uname and password in Android and IOS App.

• how to protect uname and pwd on remote ie while transferring from mobile to webservice.(I have an idea of using AES encryption Algorithm)

• how to keep webservice url safe inside app(both android and ios)

• what are the flaws could happen while creating these kind of app and how to restrict our app from Hackers?

• what are the security steps server Team need to implement (they gonna write server in php).

thanks in advance?

Answer 1

Keep the password in the keychain (iOS).

Use SSL to communicate with the server, use POST for the username/password, Pin the certificate.

The webservice URL is public, anyone with a network sniffer will be able to see it.

The major hack will be against the server. Jailbreaking can compromise the app. The keychain is rather immune to jailbreaking.

The main thing for the server is how they handle the user personal information and password. Do not save the password, just a well salted SHA hash of it.

Define the value of the data you are securing from several perspectives: The user's perspective, the value to you,, your reputation, the value to an attacker. Then design the security to the highest level of all perspectives. Keep in mind that high security can be painful to the user. Find a balance.

If you care about security there is only one answer: Have the security designed and vetted by a security domain expert. I always have my designs and code vetted. Such a domain expert will have several years of full-time security experience in this area and possibly a certification such as CISSP. Anything short of this is just a "nice try".

Security bugs are different than normal code bugs. A normal app can have quite a few bugs that are just annoying but still be usable and even a good app. One security bug and there is no security, one security bug is all the attacker needs.