Reminisce Active Member Apr 22, 2020 #1 Hello guys, I need to securely communicate with my rest api on a Mobile banking app I'm working on. I already have some security in place but I need to pin my SSL certificate inside my app, so I can prevent [MAn in the middle attacks] . I need a A~Z guide on how to go about this. A quick search on the forum returned this https://www.b4x.com/android/forum/threads/okhttp-set-parameter-with-inline-java.64748/ But, I really don't understand that thread. Thanks.
Hello guys, I need to securely communicate with my rest api on a Mobile banking app I'm working on. I already have some security in place but I need to pin my SSL certificate inside my app, so I can prevent [MAn in the middle attacks] . I need a A~Z guide on how to go about this. A quick search on the forum returned this https://www.b4x.com/android/forum/threads/okhttp-set-parameter-with-inline-java.64748/ But, I really don't understand that thread. Thanks.
Erel B4X founder Staff member Licensed User Longtime User Apr 22, 2020 #2 Regular, simple, properly configured SSL is protected from man in the middle attacks. You don't need to do anything special. Upvote 0
Regular, simple, properly configured SSL is protected from man in the middle attacks. You don't need to do anything special.
Reminisce Active Member Apr 22, 2020 #3 Erel said: Regular, simple, properly configured SSL is protected from man in the middle attacks. You don't need to do anything special. Click to expand... Are you talking about just using "https://abc.com" instead of "http://abc.com"? I saw some articles online that talked about Certificate pinning and how hackers can intercept my app's communications using a fake certificate. That' was why I opened this thread. Is there a way I can pin the SSL certificate inside the app? This way I can be rest assured of my app's integrity. Upvote 0
Erel said: Regular, simple, properly configured SSL is protected from man in the middle attacks. You don't need to do anything special. Click to expand... Are you talking about just using "https://abc.com" instead of "http://abc.com"? I saw some articles online that talked about Certificate pinning and how hackers can intercept my app's communications using a fake certificate. That' was why I opened this thread. Is there a way I can pin the SSL certificate inside the app? This way I can be rest assured of my app's integrity.
Erel B4X founder Staff member Licensed User Longtime User Apr 22, 2020 #4 This is not needed. You should understand how SSL works. Unless you are initializing OkHttp with TrustAll it will reject fake certificates. Upvote 0
This is not needed. You should understand how SSL works. Unless you are initializing OkHttp with TrustAll it will reject fake certificates.
Reminisce Active Member Apr 22, 2020 #5 @Erel, So this means as soon as I install the SSL certificate on my web server and I call the rest link with "https" inside my app,everything is under control and secured? thank you so much for that clarification. This is my first time using https inside my app. B4x products are amazing, You're very much appreciated. ? Upvote 0
@Erel, So this means as soon as I install the SSL certificate on my web server and I call the rest link with "https" inside my app,everything is under control and secured? thank you so much for that clarification. This is my first time using https inside my app. B4x products are amazing, You're very much appreciated. ?
Erel B4X founder Staff member Licensed User Longtime User Apr 22, 2020 #7 Reminisce said: this means as soon as I install the SSL certificate on my web server and I call the rest link with "https" inside my app,everything is under control and secured? Click to expand... Yes, assuming that you haven't used the "trust all" feature. For this to work the certificate should be signed by an authorized provider. This is how browsers work. Upvote 0
Reminisce said: this means as soon as I install the SSL certificate on my web server and I call the rest link with "https" inside my app,everything is under control and secured? Click to expand... Yes, assuming that you haven't used the "trust all" feature. For this to work the certificate should be signed by an authorized provider. This is how browsers work.
Reminisce Active Member Apr 22, 2020 #8 Erel said: Yes, assuming that you haven't used the "trust all" feature. For this to work the certificate should be signed by an authorized provider. This is how browsers work. Click to expand... Thanks a lot for your time sir. Thread closed. Upvote 0
Erel said: Yes, assuming that you haven't used the "trust all" feature. For this to work the certificate should be signed by an authorized provider. This is how browsers work. Click to expand... Thanks a lot for your time sir. Thread closed.
