Question

I am going to make an application (iOS and Android) that will use a web service that I am developing. I will use HTTPS and SSL so that the data sent from the app to the server is secured. However how do I stop (or make the life of people who decompile the app hard) “hackers” from decompiling the source code where the URL is written?

I don’t want other people to make an application that use my data.

The users of my app will have to register and login in order to use it. I have read something about authenticating the users and pass a key back (the way Facebook does). However wouldn’t this mean that a “hacker” could sign up and then use the same key? Would you need to track the usage of each key to look for irregular use?

The server technology is either Java EE or Scala (Lift).

Answer 1

First: There is no 100% security for anything you run on a device that is not under your control (like iOS and Android devices in your case).

You could make “abuse” harder by several measures:

• issue a session key after a successfull login with a time-limit so a new login needs to happen after a certain time has passed by
• issue an interaction key for every communication step which gets invalidated right after one usage
• when a successfull login happens terminate any other session associated with the same credentials that might be active before that login
• “throttle” usage (might be impossible depending on the specific application)

IF you really really want to make it very hard you can issue a device-specific client-certificate and use cert-based client authentication (defined in SSL standard) – you can invalidate the cert associated with the device if you see abuse without harm for the legitimate users of other devices…