I am working on an app for android with requires a authentication via SSL to protect client-server api.
I know how to do following thins:
1. Force apache http client to accept certificates issued by specified certification authority.
2. Set glassfish certificates and how to force specified web project (java EE) to require https.
What I do not know:
1. How to force glassfish to grant access only to clients using certificates issued by my certification authority.
2. How to force apache http client to send certificate of client nor how to make it choose correct client certificate.
Questions or Problems Should Not Be Posted in the Development Forum
Please Post in the Correct Forums & Read the Forum Rules
Moving to Q&A
I have managed to do it quite some time age - sorry that I did not notice community.
Basically you need to setup GlassFish3 https connections to require client certificate upon initialization. Than you need to modify GlassFish trust store and key store so that it would possess only ca/keys we want. Last step is to configure Apache http client to use trust and key store we want (those key store and trust store are a bit different for android device and glassfish server).
Anyways, if any of you would like the help on the topic, then post request here - I will post a full guide how to do it then.
Related
Here's the problem.
When I try to connect to my University's network , the my Galaxy S is able to connect JUST fine. However, when I open a browser it says the incoming certificate is not secure and then I have NO INTERNET on any page. It tries to redirect me to the login page for the network but fails to do so with a "communications error" and subsequent no internet access of any sort.
What the network is supposed to do is redirect me to the login page so that I can register the device to the network and login using my university account. My phone can't do that apparently and just sits connected to the network with NO INTERNET connectivity. How can I fix the problem?
This is the university network and the instructions how to get on it for Android devices:
http://www.colorado.edu/its/docs/wir...dwireless.html
I connect to it just fine but am UNABLE to get to that device registration/login page.
This is NOT just for my university. ANY public network which requires me to accept an "agreement" before it lets me have internet access, my phone KILLS ITSELF and CANNOT pull up the agreement page but instead tells me there is no internet. I'm SURE its a software problem or something with settings but can't figure out just what it is. Help?
Just about the only networks I can connect to on Wi-Fi are home networks.
You could see if your university has the (presumably) self-signed root certificate for their trust chain for their captive portal and install it on your Android device. That would make the browser warning go away.
You could also check if there is a "show security warnings" option in your browser and disable it to skip over the certificate entirely.
Or perhaps Samsung did something funky to the browser to explicitly forbid access to self-signed sites? I'm not too sure there, I only have HTC devices to test with.
Well the thing is I tried several browsers.
1. The default one that comes with Android
2. Opera mini
3. DolphinHD
All same thing. I'm now going to test with a beta build of Firefox for android (fennero was it called I forget) but its SUCH a stupid thing to not work. Every other device WORKS. Blackberries, Iphones, tablets, laptops....everything.
EDIT: The EXACT error I get is:
"There is a problem with the security certificate for this site. This certificate is not from a trusted authority." I get this AS it attempts to load the redirect login page (both university and at work now). Same issue. It's browser/certificate related. And its ANNOYING as hell.
EDIT 2: Found the problem. It's that stupid certificate.
"This is a result of your corporation using an in house Certificate Authority to provide SSL encryption on your mail server and clients.
Basically....the computer that issued the certificate isn't trusted by the android phone. I'm new to android so I'm not sure if you can add a trusted CA (I haven't seen any options for it).
I don't know about future updates like the above poster mentioned.
Most companies will purchase a certificate from one of the major Certificate Authorities on the internet, which are pre-programed into most operating systems to be trusted. Internal CA's are trusted by the domain environment at your work, but not by anyone else. External (Internet) CA's are trusted by everyone.
if you want an example, open up IE (gross I know) and go to your options. Click the content tab, then there should be a button label certificates. inside the certificates window select Trusted Root Certification Authorities.
That is a list of all the builtin trusted CA's provided by Microsoft and the companies that govern the internet. "
I STILL have no idea how to fix it and to make the phone accept the certificate though.
EDIT 3: Fennec (Mozilla Firefox for Android beta) managed to pull up the login page for my work network. Not sure if it will work for the university yet.
}{Alienz}{ said:
Well the thing is I tried several browsers.
1. The default one that comes with Android
2. Opera mini
3. DolphinHD
All same thing. I'm now going to test with a beta build of Firefox for android (fennero was it called I forget) but its SUCH a stupid thing to not work. Every other device WORKS. Blackberries, Iphones, tablets, laptops....everything.
EDIT: The EXACT error I get is:
"There is a problem with the security certificate for this site. This certificate is not from a trusted authority." I get this AS it attempts to load the redirect login page (both university and at work now). Same issue. It's browser/certificate related. And its ANNOYING as hell.
EDIT 2: Found the problem. It's that stupid certificate.
"This is a result of your corporation using an in house Certificate Authority to provide SSL encryption on your mail server and clients.
Basically....the computer that issued the certificate isn't trusted by the android phone. I'm new to android so I'm not sure if you can add a trusted CA (I haven't seen any options for it).
I don't know about future updates like the above poster mentioned.
Most companies will purchase a certificate from one of the major Certificate Authorities on the internet, which are pre-programed into most operating systems to be trusted. Internal CA's are trusted by the domain environment at your work, but not by anyone else. External (Internet) CA's are trusted by everyone.
if you want an example, open up IE (gross I know) and go to your options. Click the content tab, then there should be a button label certificates. inside the certificates window select Trusted Root Certification Authorities.
That is a list of all the builtin trusted CA's provided by Microsoft and the companies that govern the internet. "
I STILL have no idea how to fix it and to make the phone accept the certificate though.
EDIT 3: Fennec (Mozilla Firefox for Android beta) managed to pull up the login page for my work network. Not sure if it will work for the university yet.
Click to expand...
Click to collapse
Hate to revive a thread... but I'm having this EXACT problem trying to use Wifi at McDonald's in Spain.
Has anybody came up with ANY solution to this problem?
i have same problem on ma samsung galaxy s can`t connect to wi fi at mcdonalds any mecdonalds... it connects i get an ip but i can`t login it says i got no internet connection
Hate to bring up this thread, but i am having the same issue with 2 android 4.0 devices on my work network. Does anyone know the solution to this issue?
Hi All,
Is it possible to make an android app with the following approach?
Create an app with login control (textfield and password field).
The App button is actually submitting to a web login to get a web auth session.
The server then returning a success or failure response and at the same time the server will create a auth session for this user logon.
Then the app switch to a WebView control to browse the member page which required the auth session from the login action previously.
Simply say, it is just like mobile version of website, performing login and browsing, but moved the login part into app, use WebView to keep browsing the rest.
Hi. I'm glad to finally be here.
Let me explain the context of my question. I'm designing an application in Android that works consuming a web service. For all inquiries carried out to that web service, you must authenticate to each perform.:silly:
I tried to use SSL certificates for greater security, but at the moment it is too advanced for me just knowing how to create a certificate, then install it on the server and on the client and the connection between them that way (If anyone has a tutorial will be welcome).
For now, I managed to connect via http without any protection. To authenticate the device that performs, IMEI shipping plus a random password (created in the registry).
Well, my question is whether this is an acceptable way or is there more optimal way that take care information that those using the app.
Thank you very much for your help, since I have no one else to turn.
I am developing an app that is similar to Tinder:
I am trying to develop an app, and I have until now a simple vertifation logic, I am pretty sure that this is not the best solution, but I would like to know what you think about it:
1) The user recieves a unique access token from Facebook SDK and sends it to the server that I created. The access token saved in the user schema and updated every time the user logged in.
2) Every time the user sends a post request, our server checks that the access token is correct, and if not it doesn't response.
3) It checks the user id, and only shown imaged can be checked.
Now what i am asking is:
Is it a good security solution?
What do you think about it?
I need to run an app in Genymotion that is used for data entry and upload of the entered data into 3rd party sites. The logins to 3rd party sites are stored in this application (probably encrypted). The application will store multiple logins for my different customers of who need to have the data uploaded into the 3rd party sites. The data into the app will then be entered by other people to whom I outsource the data entry.
So I created Genymotion appliance, installed the app and in this application I entered logins for sites such as ebay. I am looking for suggestions on what can I do to secure the appliance to prevent the data being copied out from it.
I want to prevent the person to whom I outsource data entry to be able to install and load 3rd party other apps, modify system settings, install other apps, copy the system directory, copy the login and password information saved by the application.
Let's assume the worst possible case here when application is well written but the passwords mentioned above (for the ecommerce sites like ebay) is saved in plain text in this application in the internal application directory. What I know about the application is it doesn't support access to SD Card, only can read and write data to the internal memory.
What can I do in Gennymotion to improve the security of my appliance. Genymotion virtual machines are rooted. So I looked at following suggestions:
1. Setup restricted user on Android
2. Set restriction for the restricted user to only be able to use the one application. Disable anything else (including disabled browser, email, youtube etc..)
3. Try to get the restricted user loading on boot of Android. When Android restarts, however, it doesn't allow choice to login into the restricted user or the admin user, sort of like a Windows or MacOS login menu. To get the appliance to always start with restricted user by default, I need to add a script and the scripted will need to start using Tasker or MacroDroid.
However, how do I prevent the user from installing 3rd party apps? Is it good enough to disable all user apps (except that one used for data entry) from the restricted user? Is there any other way the user could abuse the access to the virtual appliance and load something there? Are there any system android apps I need to disable for the restricted user to prevent the user to be able to do anything bad with it?
The application used for data entry can not download any application or data, however, I believe it does use the webview because it loads sites like ebay and fills the forms on those sites. It only interacts with select websites only like Ebay to enter data into Ebay forms..
Is there anything I can do to secure Genymotion appliance any other than what I already mentioned. I would like to send the link to the Genymotion SaaS Android to people who will do data entry for me into Ebay and other sites. So I need to make sure the virtual appliance is secured as much as possible from tinkering with it. I need to make sure somebody doesn't get hand on the stored login details.
Just to clarify for the login credentials:
I am not sure how the user credentials are stored and I will find it out, however, for now, I go from the worst case scenario when the credentials are stored in plain text in the app settings. The user name and password is stored in the application with exception for Ebay because the many other sites do not have API key or any webservices interface, so the application would access those sites simply via a webview, and when it goes to login there it will do that by filling in the login information on the login form (simulates keystrokes). The user name and password is entered into the login form for the site. That's why the login info is stored in the application itself.
This question is not about how to secure the specific application I will be using, but how to secure the actual whole Android appliance from tinkering with.
I am aware I will the risks here, just want to do as much due diligence as I can.
Sources for Genymotion restricted user..
How to set restricted user as default user on reboot?
We would like to have an already added restricted user account be the default when we restart our Samsung SM-T580 tablets. At current we have 2 accounts installed, Admin and User The User is a use...
android.stackexchange.com
Root access - Device image User Guide
docs.genymotion.com
Done some digging so this cannot be done. Neither Genymobile or Appetize or other online Android emulators can offer fine-tuning in terms of user access. The closest is Genymobile because at least allows adding and removing access of users to individual appliances. That is however not resolving the issue with Android and in particular rooted Android, since all online emulators run rooted Android and I am not sure how that is secured against potentially malicious actors who receive access link.
The only easy way to solve it, kind of in a mickey-mousy way is to install Kiosk mode application. That kiosk app will run at every boot and it only shows the specific application. There is always risk of course the malicious user would do something to crash the application and the Kiosk app, but if the application is not a web browser or email client or similar it should be relatively safe.
There are plenty of Kiosk mode apps for Android but none of them is free (don't try to look, no chance to find one), the cheapest cost about 7 USD one-time purchase, the more expensive ones cost 20 per month per device or more and come with remote control etc... Not cheap but kiosk mode apps are almost exlusively used by businesses so that's why there is lack of free apps.
Anyhow I believe this is the closest as I could get to deal with this.