保护应用程序中的Web服务

Question

I am going to make an application (iOS and Android) that will use a web service that I am developing. I will use HTTPS and SSL so that the data sent from the app to the server is secured. However how do I stop (or make the life of people who decompile the app hard) "hackers" from decompiling the source code where the URL is written?

I don't want other people to make an application that use my data.

The users of my app will have to register and login in order to use it. I have read something about authenticating the users and pass a key back (the way Facebook does). However wouldn't this mean that a "hacker" could sign up and then use the same key? Would you need to track the usage of each key to look for irregular use?

The server technology is either Java EE or Scala (Lift).

Answer 1

First: There is no 100% security for anything you run on a device that is not under your control (like iOS and Android devices in your case).

You could make "abuse" harder by several measures:

• issue a session key after a successfull login with a time-limit so a new login needs to happen after a certain time has passed by
• issue an interaction key for every communication step which gets invalidated right after one usage
• when a successfull login happens terminate any other session associated with the same credentials that might be active before that login
• "throttle" usage (might be impossible depending on the specific application)

IF you really really want to make it very hard you can issue a device-specific client-certificate and use cert-based client authentication (defined in SSL standard) - you can invalidate the cert associated with the device if you see abuse without harm for the legitimate users of other devices...

Answer 2

This is more-or-less impossible. You can use bytecode obfuscation to make decompiling harder, but anyone who tries hard enough can see what the code is doing.

If you are allowing access to the data to people that you can't trust, then the only things you can do are to

• ask nicely (please don't abuse my data)
• authenticate users so you can monitor individual usage, and maybe apply usage or rate limits (like Twitter does)
• make people sign a legal agreement (unlikely to attract many users unless your data/app is very valuable to them!)

Also consider whether you can do more server-side processing so that less raw data is sent to the client. I don't know what your data is like, but taking the example of maps, if you send a pre-rendered bitmap rather than some lat/long vector data, then extracting anything useful is much harder work.