1

I was thinking about making a new Android application. But in this one I need to use MySql connection to one of my web pages. But I was wondering is this safe? Can you decompile a apk app and find the user name and password used by the Android app? And if so, what is the most secure way to create such an application?

Thanks for all the help and replays.

suxSx
  • 212
  • 1
  • 5
  • 16
  • 1
    I can't imagine this would be safe. Even if decompiling isn't an issue, I'm sure there are ways to look at the data sent to the server. Why don't you make it connect to an http server and have your own php script handle the connection for example? – Patrickdev Dec 31 '12 at 10:09
  • 1
    You can use encryption of your data use this link - http://stackoverflow.com/questions/6043984/sqlite-encryption-for-android – Vashishth Dec 31 '12 at 10:12
  • A http request was my first though, but then I come to think about using mySQL. But how every I turn my head around, I cant figure out a safe way to do it. So I think I will stick with http, but https://guardianproject.info/code/sqlcipher/ was worth checking out. Maybe I will find some use for it. :) – suxSx Dec 31 '12 at 10:23

1 Answers1

0

Encrypting the sql queries will secure your app when someone attempts to sniff/snoop the data between the app and the server, but when decompiling the app, anyone will get your connection parameters including username and password.

You have 2 clean solutions to look at:

(1) Use webservices, you may choose to use SOAP webservices, these are the most standardize services and you'll get no problems for reusing your webservices in other apps/languages as interoperability is what standardized webservices come from, but SOAP implies more data to transfer, parse and unparse; SOAP is a heavy-weight XML standard that is centered around document passing and is slow for high throughput apps.

REST webservices are very lightweight, and relies upon the HTTP standard to do it's work. It is great to get a useful web service up and running quickly. If you don't need a strict API definition, this is the way to go. Most web services fall into this category. REST is faster but there's no real interoperability politics in it.

(2) Use data streams (or websockets) if your apps is consuming large amount of data through webservices (video, file upload ...)

zfou
  • 891
  • 1
  • 10
  • 33