Question

I have a application (made in Delphi) that contains a Authentication system (login & password).

This system is in PHP, and the application get results from PHP using HTTP GET method.
The system returns ‘OK’ if login and password are correct, and ‘NO’ if not correct.

Like this…

procedure Check;
var
 x: string;
begin
 x:=Get('www.mywebsite.com/auth.php?user=xxxxxx&pass=zzzzzz');
 if x='OK' then 
  UnlockFeatures
 else
  MessageBox(0,'You're not VIP','Error',0);
end;

Well, it works fine, but it is very easy to circumvent this system with sniffers, packet editor or proxy.

So, I want to get some information (in PHP) that changes every time, and that could be possible get the same information by my application.

What can I do?

I don’t need codes. Just tips, suggestions, please…

Thanks…

Answer 1

Generally i suggest you not to try to outsmart everyone and invent brand new bicycle – you’d 99% fail with some stupid error making your approach completely insecure. There were a lot of precedences like DVD encryption or Win95 security. You’d better try some industry-approved mechanics, that for years been tested for security, that should have readymade implementations for both Delphi and PHP. Few are

• TLS (https:// protocol) http://en.wikipedia.org/wiki/Transport_Layer_Security – that would give no protection from MITM attacks, but it sounds exactly what you asked and would require least possible change.
• You may try implementing SSO via integrated windows authentication if you server would support that
• You may try setting up OpenID or OAuth environments. Generally their v.1 would be simpler than v.2
• You may try to bail out of HTTP and use XMPP/Jabber authentication – they take security seriously and libraries for PHP and Delphi exist. Though it should not be much more secure than just using TLS, you may hope that dumb attackers would not be prepared for non-HTTP protocols (there is not internet outside Facebook and such).
• You may use Bluetooth-like approach to make special connection(“handshake”) once (when both client and servers are controlled) just to make special “tokens” interchanged and stored. That is a generic trait to use “controlled environment” to make 1st connection and use some tokens to prove “we had met before” on later connections using generic challenge/response trait. Those tokens should be unique for each client-user-server combinations! If you’d make one server-global clients-shared set of tokens – they would just be easily copied form one client to another and no more security remains.
• • Those may be coefficients for some not most trivial RNG. constructed be server and saved by both client and server. Then server “challenges” with RNG seed and client should response with proper random value, prooving he knows coefficients.
• • Those may be some asymmetric crypto, where token is some random “message”, then server sends client encruyption keys and expects the correct message encrypted by them, or the token is the password and server generates random text and expects it’s correct crypto digital signature to be passed back. You may find encyption libraries at Torry.net for examples. Lockbox3 and Spring4Delphi are among most tested and noted crypto libraries for Delphi implementing some encrypting standards.

Consider you priorities and make your choice.
Would you be able to switch all the authentication layer in one key turn later, having absolutely no care for backward compatibility with non-updated clients, then you might choose the most simple one and only enhance it later if needed. If your users are lazy at upgrades then you’d better choose most secure approach from starters, since you would have no practical way to disable insecure implementation later.