I am building an app that creates a http connection between Android and a specific Server. I transfer data using JSON and all is going well, but now I am trying to secure the connection, by which I mean I don’t want a third party to view the data being uploaded. The Server doesn’t use SSL certificates and so I am currently thinking of how to implement a secure connection. So far I have two ideas:
- Create a self-signed certificate and put it on the server file system. Problem with htis is that the Server owner doesn’t want me poking around his system. I’d rather not get into a debate with him about it
- Use Jsch (or other) SSH library to create a secure connection. Problem with thisis, I have never used SSH before.
What do you recommend? Is there another option?
Get them to setup SSL on the server and be done with it. Since the server has to decrypt the data, you need to do something on the server, whether that is installing a key and certificate or modifying the web app to decrypt your data. Using SSL is by far the best option. SSH can be tricky, and they might be less likely to allow SSH connections from mobile devices than regular HTTP(S).