Re: [android-security-discuss] Restful web service authentication security measures

2012-12-16 Thread Kristopher Micinski
Ah, and indeed, their library for Java works for Android... http://code.google.com/p/oauth-signpost/ Sorry, I didn't mean to derail the discussion on safe protocols but just wanted to provide some perspective on auth protocols that you'll see most people using. (I.e., Facebook, Twitter,..,) It

Re: [android-security-discuss] Restful web service authentication security measures

2012-12-16 Thread Kristopher Micinski
No disrespect taken, I just wondered if he'd taken a practical viewpoint (everyone uses it) to his auth problem. I didn't really see any mention of why the OP wanted a more elaborate approach, and since the aura I pick up from him seems to indicate he wants a "works with my app" rather than "very

Re: [android-security-discuss] Restful web service authentication security measures

2012-12-16 Thread Jeffrey Walton
On Sun, Dec 16, 2012 at 12:02 AM, Rajiv Yadav wrote: > Hi Kris, > I tried but oauth but setting up an provider of wcf end was bit tricky > for me. > I don't know .net much . > If you have some sample for Oauth android - wcf integration with own > provider plz share. > OAuth confers trust to a t

Re: [android-security-discuss] Restful web service authentication security measures

2012-12-15 Thread Kristopher Micinski
I feel confident one must exist, as many apps using it exist, and I would be surprised if none of them used an open source library... kris On Sun, Dec 16, 2012 at 12:02 AM, Rajiv Yadav wrote: > Hi Kris, > I tried but oauth but setting up an provider of wcf end was bit tricky > for me. > I don'

Re: [android-security-discuss] Restful web service authentication security measures

2012-12-15 Thread Rajiv Yadav
Hi Kris, I tried but oauth but setting up an provider of wcf end was bit tricky for me. I don't know .net much . If you have some sample for Oauth android - wcf integration with own provider plz share. On Sat, Dec 15, 2012 at 10:24 PM, Kristopher Micinski < krismicin...@gmail.com> wrote: > Jus

Re: [android-security-discuss] Restful web service authentication security measures

2012-12-15 Thread Kristopher Micinski
Just out of curiosity, have you looked at implementations of OAuth on Android...? kris On Fri, Dec 14, 2012 at 5:12 AM, Rajiv Yadav wrote: > Hi all, > I have an easy and basic approach for doing this: > . > >1. getKey(uuid, timestamp) >It will call the server and get a tempary key and

Re: [android-security-discuss] Restful web service authentication security measures

2012-12-14 Thread Jeffrey Walton
On Fri, Dec 14, 2012 at 5:12 AM, Rajiv Yadav wrote: > Hi all, > I have an easy and basic approach for doing this: > . > >1. getKey(uuid, timestamp) >It will call the server and get a tempary key and service will store >uuid and timestamp, and key > >2. Login(encrypted-key,username

Re: [android-security-discuss] Restful web service authentication security measures

2012-12-14 Thread sampath premarathna
sound good to me.Let see On Fri, Dec 14, 2012 at 3:42 PM, Rajiv Yadav wrote: > authentication -- *~sampathpremarathna~* -- You received this message because you are subscribed to the Google Groups "Android Security Discussions" group. To post to this group, send email to android-secu

Re: [android-security-discuss] Restful web service authentication security measures

2012-12-14 Thread Rajiv Yadav
Hi all, I have an easy and basic approach for doing this: . 1. getKey(uuid, timestamp) It will call the server and get a tempary key and service will store uuid and timestamp, and key 2. Login(encrypted-key,username,other credentials) password will encrypt the key by MD5 and se

Re: [android-security-discuss] Restful web service authentication security measures

2012-12-07 Thread sampath premarathna
But in your solution anyone in the middle can get that token also,so he can intercept and change the request no? On Monday, November 5, 2012 11:52:17 PM UTC+5:30, Jeffrey Walton wrote: > > On Fri, Nov 2, 2012 at 12:06 AM, Rajiv Yadav > > > wrote: > > Hi i am developing an application which

Re: [android-security-discuss] Restful web service authentication security measures

2012-12-07 Thread Jeffrey Walton
On Fri, Dec 7, 2012 at 5:45 AM, sampath premarathna wrote: > But in your solution anyone in the middle can get that token also,so he can > intercept and change the request no? You would run your application over VPN or SSL/TLS. The token is large and random (96-bits or 128-bits), so it can't be ef

Re: [android-security-discuss] Restful web service authentication security measures

2012-11-05 Thread Jeffrey Walton
On Fri, Nov 2, 2012 at 12:06 AM, Rajiv Yadav wrote: > Hi i am developing an application which uses restful services. (near about > 30 restful methods some are using "get" and some of are "post") > It is working fine but in each call throughout the application i need to > send some secure data (lik

Re: [android-security-discuss] Restful web service authentication security measures

2012-11-05 Thread Brian Carlstrom
HttpsURLConnection? On Thu, Nov 1, 2012 at 9:06 PM, Rajiv Yadav wrote: > Hi i am developing an application which uses restful services. (near about > 30 restful methods some are using "get" and some of are "post") > It is working fine but in each call throughout the application i need to > send s

[android-security-discuss] Restful web service authentication security measures

2012-11-05 Thread Rajiv Yadav
Hi i am developing an application which uses restful services. (near about 30 restful methods some are using "get" and some of are "post") It is working fine but in each call throughout the application i need to send some secure data (like username, password in some encrypted form). my question