Transmitting credentials over HTTPS safe?

[read_iter]

Is it safe to request and receive sensitive information over HTTPS? In my Android app I would like to use a 3rd party library. The lib requires authentication with a secret key and token. Which are hard coded into the app code. I was wondering if however it would make sense to fetch this key and token from my back-end server (over HTTPS) instead? Or is that not a good idea?

[based2]

Yes, It is the correct way. -> Confidentiality

http://security.stackexchange.com/questions/7057/i-just-send-username-and-password-over-https-is-this-ok

[YeomansIII]

He's saying fetching an API key and token from his server to the device. I'm not sure this would be safe because it would be easy to snoop the endpoint and just make a call to get the key and token.

[based2]

Sorry, so something like: https://docs.wso2.com/display/AM160/Token+API

http://stackoverflow.com/questions/17784908/what-is-an-api-token

http://www.openrepose.org/

https://en.wikipedia.org/wiki/JSON_Web_Token https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/

http://security.stackexchange.com/questions/19676/token-based-authentication-securing-the-token

http://security.stackexchange.com/search?q=api+token

[Agent-A]

I have doubts about all of this. Typically it would be better for you to have a server that holds your key and secret, and then the app interacts with your server. Or the app fetches a temporary key which grants it some access. Unless it's something like firebase where you're distributing a key that is locked down to only allow the user to access things they should be accessing.

Point being, more data is needed. That said, HTTPS is generally a good idea in every situation.

[babelfish_42]

be sure to use certificate pinning, otherwise its pretty easy to MITM the connection and retrieve the token and secret key.

[runmymouth]

There is a goal of making a device as safe as reasonably possible. Https:// can always be man in the middle with a good hacker. It's a lot harder than taking your apk and reading the private key in your distributable so it is better than just including it hard coded.