0

I'm currently developing an app for iOS-devices. This app downloads data from a wordpress blog, but fetches a nonce-token first. This has been tested, and is showing to take about 2~3 seconds, which is a lot, considering it's a mobile device that should have the data ready in a few seconds. In addition to this, the data has to be downloaded as well, which takes another 4~5 seconds.

In the data-fetching-method there are several security-measures taken, for example a secret string that needs to match on both the web-server and device (of course encrypted), and some sort of simple UDID-validation + some header and useragent-tests. Is this enough, or do I really need the nonces? It's not like there is any sensitive data being passed through, and if it was, I'd of course encrypt it further.

Is it really necessary for me to use nonces?
Thank you.

10
  • 4
    If there's no sensitive data involved, why all the security? Seriously, without understanding your security needs, what use can we be here? Jun 20, 2011 at 19:54
  • What are you security requirements? Only authorized users allowed to retrieve the data, secure tracking of those users, etc...?
    – Marc B
    Jun 20, 2011 at 19:54
  • All iPhone-devices with the app can fetch data. It is mostly to avoid hackers trying to overload the server, but that is probably not too dangerous, or is it?
    – Emil
    Jun 20, 2011 at 19:59
  • Never heard that mobile devices are actually fast with their internet access. Maybe you should just tweak the loading animation so it looks faster and more sexy? - And some other question: Ever thought of dropping Wordpress when you're looking for speed?
    – hakre
    Jun 20, 2011 at 19:59
  • The current security procedures is nonces, secret string verification and simple UDID-validation (regex a-f, 0-9, 42 chars)
    – Emil
    Jun 20, 2011 at 20:00

1 Answer 1

1

If you are downloading public data, there's no need for the nonce authentication stuff.

If you are going to be modifying data on the server, or fetching data that is not public or otherwise has some kind of access control around it, then you'll need whatever mechanism Wordpress requires to gain access (which it sounds like is a nonce-based token approach).

If it's taking a few seconds to get that token, how about fetching it on app startup/resume in the background?

1
  • It's simply public data, so I'll just remove it :) Thanks to @David Thornley and @hakre who commented on the question as well.
    – Emil
    Jun 20, 2011 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.