What decryption should i use between my Android app and ASP.NET Webservice?

Question

I am searching a good way to encrypt and decrypt user authentication data between my Android app and my ASP.NET Webservice built in C#.

I want to do a user registration on my Android app and send the authentication to the back-end server that is a ASP.NET Webservice built in C# and then every time the app calls the webservice it should send a hashed string with authentication information so webservice now what user it is.

What is the best practice for this and have i missed something, give me some ideas please!

Answer 1

If you just send a hashed or encrypted string, anyone that captures it, can re-send it, and authenticate without knowing the password, etc. (replay). Use HTTPS (HTTP over SSL) and you don't have to worry about encrypting the communication channel.