Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I am developing an Android application for my final year project which allows the holder of a mobile device to receive a text notification containing potentially sensitive information from a server.

My question is this, if a User downloads the application, what is a suitable way for them to create an account / log in on my server to receive notifications from it?

I was thinking:

Application

  • Open application
  • Click Register
  • Fill out fields (Name / Address / ID / Phone no.)
  • Send to server
  • Display "Account Pending"
  • If approved, send positive message, begin receiving notifications from server.
  • If denied, send negative message, if User tries to log in with that account, the App will inform them that it was rejected.

Server

  • Add received information to a "Pending Account"
  • When an Admin comes online, they can review the information (How can they be sure the person is who they say they are?)
  • If the account is approved, the details are moved to a normal User account, otherwise moved to rejected accounts.

I can't think of another solution which would fit this problem. If anybody knows of a patterns or design I appropriate to hear from you.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Modifying the answer, according to the conversation in the comments.

You mentioned this is security-sensitive, and thus you cannot trust people from the Internet without a strong security token. Assuming the people have secured work emails (connection between the email client and server is never plain text), you can probably create the user accounts centrally on the server, according to their required privileges, and send the first-time passwords to them via email. They can then log in to the system using their email address and the password. Normally they also need to change the password immediately. You may decide to activate their privileges only after they log in for the first time and change their password.

share|improve this answer
    
Thanks for the reply, an example run of the application would be this: A person opens a high security door on the 2nd level of some military base. After the door has been opened, a message is sent to some of the security to their mobiles saying who has just opened which door. I need a way to allow the security guards to install the application on their mobile devices and register their mobile to receive notifications about the doors being monitored. At the same time I need to be sure it is in fact them who is registering to receive updates. –  Tom celic Apr 2 '13 at 10:20
    
Then the key question is how you can authenticate the user. You probably need to pre-register users and distribute their user/password to them outside the system. Is it like what you want? –  Yongwei Wu Apr 2 '13 at 10:26
    
Yeah exactly,.I was thinking, if the security guards work for the company this system is going to be on, I would have a list of their work usernames / emails, which I could send keys to –  Tom celic Apr 2 '13 at 10:29
    
It is a chicken-and-egg problem. You cannot authenticate users without having their accounts first, and you cannot trust people from the Internet without a strong security token. So in fact you need to create their user accounts first. However, instead of giving them username/password, you can also choose to give them a once-time passcode that maps to one account, and allow them to create their own username and password. It still looks like overkill. As you mentioned they have work emails, why don't just user the email as the login name, and mail their password to their email? –  Yongwei Wu Apr 2 '13 at 10:43
    
I was just making an assumption they would have work emails / usernames but I think it is the best bet so far, thanks ! –  Tom celic Apr 2 '13 at 11:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.