End to End Encryption

[Evans Attafuah]

Please, can anyone assist me on how I will handle end to end encryption on Android and iOS using firebase?

[Jacob Wenger]

Hey there,

Firebase sends data over an HTTPS connection, so the data is already being encrypted for you. No work required. Are you referring to some other form of encryption?

Jacob

On Wed, Jun 3, 2015 at 4:44 AM, Evans Attafuah <evans.a...@gmail.com> wrote:

Please, can anyone assist me on how I will handle end to end encryption on Android and iOS using firebase?

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.
To post to this group, send email to fireba...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/CAGr72X9tONsxWyfkxpuj7yvMJ1Y2vtzq2XjBC296j%3DOJYCYrsg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

[Evans Attafuah]

Hello Jacob,

Yes was referring to the actual data being encrypted so lets say "whats up" becomes some unreadable string like "435abZu". Since the rule of the book is never to role out your own crypto, I thought this was an optional bake in. 

But if anyone could point me to a resource for iOS and Android to encrypt and decrypt data, will be very glad. 

[Jacob Wenger]

Hey Evans,

End-to-end encryption typically refers to encrypting data on the client, in transit, and at rest. Firebase handles encrypting your data in transit (since it is sent via HTTPS), you as a developer handle encryption on the client if you want it, and Firebase does not yet do encryption at rest (although this is on our longterm roadmap). 

As for resources for encryption on iOS and Android, here are some links:

• About Cryptographic Services (Mac Developer Library)
• Encrypting and Hashing Data (iOS Developer Library)
• Cipher class (Android developer docs)
• javax.crypto package (Android developer docs)

Hopefully some of those are useful for you!

Jacob

--

You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.
To post to this group, send email to fireba...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/3b069b77-4ad2-4d4e-97a1-cdccc2fc35b5%40googlegroups.com.

[Evans Attafuah]

Hello Jacob,

Thanks for this.

[Jozef Matus]

Hi Jacob, I thought that firebase is using Web-sockets so its not sending data over an https connection or am I wrong?

Thank you

Jozef

[Jacob Wenger]

Websockets and HTTPS are not mutually exclusive. Read through the Wikipedia article on websockets for more info. Here are some relevant tidbits:

While the WebSocket protocol itself is unaware of proxy servers and firewalls, it features an HTTP-compatible handshake thus allowing HTTP servers to share their default HTTP and HTTPS ports (80 and 443) with a WebSocket gateway or server. The WebSocket protocol defines a ws:// and wss:// prefix to indicate a WebSocket and a WebSocket Secure connection, respectively. 

If an encrypted WebSocket connection is used, then the use of Transport Layer Security (TLS) in the WebSocket Secure connection ensures that an HTTP CONNECT command is issued when the browser is configured to use an explicit proxy server. This sets up a tunnel, which provides low-level end-to-end TCP communication through the HTTP proxy, between the WebSocket Secure client and the WebSocket server.

Cheers,

Jacob

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-talk+unsubscribe@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/3d1bde59-52b1-4da1-bf6f-0412128b60ed%40googlegroups.com.

[David Szabo]

Hi Evans,

Here's a sample for an end-to-end encrypted chat app in Firebase: (iOS) https://github.com/VirgilSecurity/demo-firebase-ios (Android) https://github.com/VirgilSecurity/demo-firebase-android

HTH,

David