KATG iPhone App Take 3

[hayroob]

Originally Posted by jnilsson

hi all,


well i just wanted to say that i have started working on the android version of the KATG app...

What im doing is copying the layout of the iphone app... i got the iphone source so im looking into that to see what it does etc....

i have not really programmed a lot in java so its going slowly but trying to get there...

currently im working on the streaming function and the check to see if the feed is live. I'll get some code setup on git soon...

regards,

jonas

That is great, I tried to get into android but it was a real mind fuck for me. Let me know what ya need and I'll get on it right away.

If you want I can add you to my github account so that both apps can be hosted in the same place and I can hopefully submit some patches to help you along.

And I can add a section to katgapp.com for the android stuff.

[jnilsson]

Originally Posted by hayroob

That is great, I tried to get into android but it was a real mind fuck for me. Let me know what ya need and I'll get on it right away.

If you want I can add you to my github account so that both apps can be hosted in the same place and I can hopefully submit some patches to help you along.

And I can add a section to katgapp.com for the android stuff.

hey,

my git username is jnilsson... android development is sh** and i never liked java, but got the phone and want the app so.... anyway, its going to take some time but i'll get it done.

[hayroob]

Originally Posted by jnilsson

hey,

my git username is jnilsson... android development is sh** and i never liked java, but got the phone and want the app so.... anyway, its going to take some time but i'll get it done.

not having a phone is what stopped me dead in my tracks.

I made a repository and added you as a collaborator so I think you can add a key and start making commits.

[hayroob]

So this is what I've been working on instead of posting here for the last few days:
Secure Persistent Login With Very Little SSL Part 1 | Get It Down On Paper
and
Secure Persistent Login With Very Little SSL Part 2 | Get It Down On Paper

If you're into web programming/security let me know what you think.

[Subsonix]

Originally Posted by hayroob

So this is what I've been working on instead of posting here for the last few days:
Secure Persistent Login With Very Little SSL Part 1 | Get It Down On Paper
and
Secure Persistent Login With Very Little SSL Part 2 | Get It Down On Paper

If you're into web programming/security let me know what you think.

I DO NOT KAY YOUR BLOG.

Please add pictures and funneh to explain.

KTHNKBAI.

[colk]

I see an issue the cookie has to be valid for both the http side and the https , otherwise when you switch to http after logging in you will get stuck in a login loop. One way to accomplish this is to have the cookie set via http point to the https id using a secure identifier (ie salt etc). The main issue is the cookie for http will be passed in clear text over the wire so whatever info you put into it cannot be used to login directly to the site if someone yanked the cookie. Also, you should look into separating your HTML and php using something like smarty. (Just a suggestion makes the code look clean)

[hayroob]

Originally Posted by colk

I see an issue the cookie has to be valid for both the http side and the https , otherwise when you switch to http after logging in you will get stuck in a login loop. One way to accomplish this is to have the cookie set via http point to the https id using a secure identifier (ie salt etc). The main issue is the cookie for http will be passed in clear text over the wire so whatever info you put into it cannot be used to login directly to the site if someone yanked the cookie. Also, you should look into separating your HTML and php using something like smarty. (Just a suggestion makes the code look clean)

I'll look into the smarty thing, I do enjoy clean code.

I think you misunderstood, there is a php session cookie that works over http and https that is responsible for actually being logged in, the https hash cookie (snickers to himself) is only responsible for reauthentication which is done over https.

If there's confusing or poorly explained language in my article I would love feedback to make it more clear.

EDIT: I have added a link to my live implementation in part 1