Home/ Questions/Q 6849595
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T01:00:39+00:00

I have written apps that run on both iPhone and Android. They make calls

  • 0

I have written apps that run on both iPhone and Android. They make calls (HTTP POST requests) to a PHP script on my Ubuntu server that retrieves queries from MySQL server there, etc.

Basically I want to encrypt these messages going back and forth. I have the additional constraint that I am on shared hosting and so do not have root (or sudoer) access on my server.

What is the best way to implement this? I don’t want something where I have to pay verisign for a cert (I know very little about security). I am thinking it will somehow involve a public/private key scheme, but I am not sure what is the best method for this.

any thoughts? thanks.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If you are on a shared hosting server, it is likely a bit of a challenge (and, depending on the provider’s setup, impossible) to secure your keys from other users. Plus, reinventing the encryption wheel is generally a bad idea. So I wouldn’t go that route, especially if you aren’t knowledgable about security.

    The easiest solution is to use SSL. If you really don’t want to get a cert from Verisign (or Comodo or whomever), use your provider’s default SSL cert. If they have things set up so that your SSL server will use a cert for https://www.YourHostingProvider.com/, then you should be able to make that work, perhaps with a bit of homework. (MediaTemple is set up that way, where you get their cert if you don’t have your own. Not sure about other hosting providers.)

    Do try to educate yourself about the elevated risks involved in doing this on the cheap. For example, depending on the setup, it’s possible that anyone else on the shared hosting service could impersonate your site if they are sufficiently skilled and determined, since they may have access to the same SSL private key you’re using.

    If you’re securing game high scores or something, that will probably be OK. If you’re securing credit card numbers or people’s personal health information, this is definitely not the way to go. You don’t want to store that kind of information on a shared hosting service, and you definitely don’t want to be so resource starved that you’re reluctant to buy an SSL cert.

    • 0