How to safely transfer a password from an Android application to a PHP server

Question

The server stored passwords encrypted using the Blowfish method. for example

$2a$10$dfda807d832b094184faeu1elwhtR2Xhtuvs3R9J1nfRGBCudCCzC

From the Android side, a username and password is sent in an unencrypted form to the server, where the same password is generated from the password on the server and the transmitted password and a comparison is made.

Question: How to transfer the unencrypted password from the android to the server safely, that is, in encrypted form and on the server to compare with the existing password?

How to transfer to transfer unencrypted password from android in encrypted form?

Pavel Mayorov Pavel Mayorov 48.9k five 50 110 · Answer 1 · 2015-07-31T12:35:37

@Visman wrote correctly, but for some reason in the comments, and not in the answers. To securely transmit anything to the server, use an encrypted connection. The simplest case is https.

Authorization on https, even if the rest of the work is done on http - has long been a standard for web applications.

Pavel Mayorov

48.9k five 50 110

The fact is that this is not a web application, but a native one. Transfer is carried out via HTTP Client in Android using POST request. The fact is that the login is entered not on the website of any kind, but on the developed Android application - Mac
And what is the problem to pass on https credentials entered not on the site, but in the application? - Pavel Mayorov
this is an idea. So just write perez domain name https: //? - Mac
Well, if everything is in order on the server with the certificate, then yes, you can do it. Still sometimes certificate pinning is done. But this, in general, is not necessary. - Pavel Mayorov
not unfortunately just a fix for https: // not working - Mac

|

Grinya Lesnoy Grinya Lesnoy 805 five 7 · Answer 2 · 2015-07-31T12:30:21

Password is a string. Transform it by any known algorithm to you (yes, change the syllable in some places, and multiply all numbers by 17 or intermediate letters by some rule - roughly speaking), and perform the inverse transformation on the server. In case someone opens your application and explodes in it, of course, it will not save, but it can protect you from a simple interception of a password (as long as the attacker does not know the formula - for him it will be a simple set of characters - no more)

Answer 3 · 2015-07-31T12:29:33

Blowfish itself is not safe. Try using AES-512 + asynchronous. encryption on android. Create applications for the droid .... Example:

  Алиса кладет свое письмо в железный ящик и, заперев его на замок, отправляет Бобу. Боб при получении ящика, (внимание!) берет свой замок и, дополнительно заперев им ящик, отправляет обратно. Алисе ящик приходит уже с двумя замками (напомню с первым замком Алисы от которого у нее есть ключ, и со вторым — Боба, от которого ключ есть есть только у Боба). Алиса снимает свой замок, и отправляет ящик обратно Бобу Бобу приходит ящик с уже одним его замком от которого у него есть ключ Боб отпирает оставшийся его замок своим ключем, и читает сообщение.

How to safely transfer a password from an Android application to a PHP server

3 answers 3

More articles: