{"action":"created","issue":{"url":"https://api.github.com/repos/igarape/copcast-admin/issues/204","labels_url":"https://api.github.com/repos/igarape/copcast-admin/issues/204/labels{/name}","comments_url":"https://api.github.com/repos/igarape/copcast-admin/issues/204/comments","events_url":"https://api.github.com/repos/igarape/copcast-admin/issues/204/events","html_url":"https://github.com/igarape/copcast-admin/issues/204","id":127931875,"number":204,"title":"Register device and sign all information sent to the API server","user":{"login":"martelli","id":239168,"avatar_url":"https://avatars.githubusercontent.com/u/239168?v=3","gravatar_id":"","url":"https://api.github.com/users/martelli","html_url":"https://github.com/martelli","followers_url":"https://api.github.com/users/martelli/followers","following_url":"https://api.github.com/users/martelli/following{/other_user}","gists_url":"https://api.github.com/users/martelli/gists{/gist_id}","starred_url":"https://api.github.com/users/martelli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martelli/subscriptions","organizations_url":"https://api.github.com/users/martelli/orgs","repos_url":"https://api.github.com/users/martelli/repos","events_url":"https://api.github.com/users/martelli/events{/privacy}","received_events_url":"https://api.github.com/users/martelli/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/igarape/copcast-admin/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/igarape/copcast-admin/labels/Security","name":"Security","color":"fef2c0"},{"url":"https://api.github.com/repos/igarape/copcast-admin/labels/wontfix","name":"wontfix","color":"ffffff"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-01-21T14:09:57Z","updated_at":"2016-01-21T14:13:43Z","closed_at":"2016-01-21T14:13:43Z","body":"Currently we cannot determine if a mobile belongs to our system or not. Anyone with credentials could log into any device and start sending information. This means one could switch his/her mobile and go undetected using a \"ghost\" mobile. This \"ghost\" mobile could connect to a untrusted network or even run a tampered version of the Copcast application.\r\n\r\nTo avoid this situation, the idea is the use the Android KeyStore to store device identification information. \r\nIn summary, each mobile will generate a pair of public/private keys and the public key would be stored into the server, along with its IMEI, during a device registration phase. During operations, the private key and the IMEI would be used to sign all information sent to the server, which would be able verify it, validating the device and SIM card used. If desired, it is possible to also send the applications certificate information, thus allowing the system to detect apk tampering.\r\n\r\nIn summary, we would:\r\n\r\n- implement a signing mechanism using the android keystore.\r\n- enhance the upload routines to sign all information sent to the server.\r\n- create a device registration procedure, to generate the key pair and register the device into the server.\r\n- implement a signature validation routine on the server, which would broadcast an alert in case of failure."},"comment":{"url":"https://api.github.com/repos/igarape/copcast-admin/issues/comments/173580616","html_url":"https://github.com/igarape/copcast-admin/issues/204#issuecomment-173580616","issue_url":"https://api.github.com/repos/igarape/copcast-admin/issues/204","id":173580616,"user":{"login":"martelli","id":239168,"avatar_url":"https://avatars.githubusercontent.com/u/239168?v=3","gravatar_id":"","url":"https://api.github.com/users/martelli","html_url":"https://github.com/martelli","followers_url":"https://api.github.com/users/martelli/followers","following_url":"https://api.github.com/users/martelli/following{/other_user}","gists_url":"https://api.github.com/users/martelli/gists{/gist_id}","starred_url":"https://api.github.com/users/martelli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martelli/subscriptions","organizations_url":"https://api.github.com/users/martelli/orgs","repos_url":"https://api.github.com/users/martelli/repos","events_url":"https://api.github.com/users/martelli/events{/privacy}","received_events_url":"https://api.github.com/users/martelli/received_events","type":"User","site_admin":false},"created_at":"2016-01-21T14:13:43Z","updated_at":"2016-01-21T14:13:43Z","body":"https://github.com/igarape/copcast-android/issues/126"}}