Amol Pawar

Secure communication is the backbone of modern financial app development. HTTPS, powered by TLS (Transport Layer Security), ensures that the data exchanged between your app and its server stays protected from unauthorized access. In this blog, we’ll explore HTTPS communication on Android, focusing on TLS 1.3—the latest and most secure version of the protocol. We’ll guide you through the process of implementing secure communication in Kotlin, simplifying each step with clear, jargon-free explanations.

What is HTTPS and TLS?

HTTPS
HTTPS (Hypertext Transfer Protocol Secure) is an upgrade to HTTP, designed to secure the communication between web clients and servers. It uses TLS (Transport Layer Security) to encrypt the data, protecting it from interception during transmission. This is especially important for safeguarding sensitive details like passwords, payment information, or personal data.

TLS
TLS is a cryptographic protocol that offers three core protections:

• Encryption: Ensures that data remains confidential and cannot be accessed by unauthorized parties.
• Authentication: Confirms that the server is legitimate and, optionally, verifies the client’s identity.
• Integrity: Guarantees that the data hasn’t been modified during transmission.

TLS 1.3
TLS 1.3, the latest version of the protocol, brings several key enhancements:

• Improved Handshake Performance: Reduces the time needed to establish a secure connection.
• Stronger Encryption: Implements more robust encryption methods for better security.
• Simplified Protocol: Strips away outdated features, reducing potential vulnerabilities.

Why HTTPS and TLS 1.3?

HTTPS
As the secure version of HTTP, HTTPS uses TLS to encrypt the data exchanged between the app and the server. In the context of financial applications, HTTPS offers:

• Confidentiality: Safeguards sensitive information like user credentials and transaction data from being intercepted.
• Data Integrity: Ensures the information sent and received is unchanged during transit.
• Server Authentication: Verifies the authenticity of the server, helping protect against fraud and man-in-the-middle attacks.

TLS 1.3
TLS 1.3, released in 2018, brings numerous advantages over previous versions:

• Stronger Security: Phases out older, vulnerable protocols such as RSA key exchange, making the connection more secure.
• Faster Handshakes: Simplifies the connection process, improving speed and reducing delay.
• Forward Secrecy: Even if an attacker gains access to a server’s private key, past communication remains secure.

For financial apps, using TLS 1.3 is essential to ensure both robust security and a smooth, responsive user experience.

Setting Up HTTPS in Android Apps

Android natively supports HTTPS, but to make sure your app works with TLS 1.3, you’ll need to configure a few settings and understand the requirements.

Prerequisites

• Make sure your app is targeting Android 10 (API level 29) or higher, as this version comes with native support for TLS 1.3.
• Install a valid SSL certificate on the server hosting your APIs to establish secure communication.

Step-by-Step Implementation

// Use the latest version in the future.
implementation("com.squareup.okhttp3:okhttp:4.12.0") 
implementation("com.google.code.gson:gson:2.12.0")

We’ll utilize OkHttp for handling HTTPS requests, as it offers a lightweight and efficient solution.

Creating a Secure HTTP Client

To enable HTTPS with TLS 1.3, configure OkHttp’s OkHttpClient. This client will handle secure communication with your backend.

import okhttp3.OkHttpClient
import okhttp3.Request
import okhttp3.Response
import java.util.concurrent.TimeUnit

fun createSecureHttpClient(): OkHttpClient {
    return OkHttpClient.Builder()
        .connectTimeout(30, TimeUnit.SECONDS)
        .readTimeout(30, TimeUnit.SECONDS)
        .writeTimeout(30, TimeUnit.SECONDS)
        .build()
}

Here,

• connectTimeout: The maximum duration allowed for establishing a connection.
• readTimeout: The maximum time allowed to wait for data after the connection is established.
• writeTimeout: The maximum time allowed to wait while sending data to the server.

With Android 10 and higher versions supporting TLS 1.3 natively, no extra configuration is needed for the protocol. The OkHttp client automatically negotiates the highest version it supports.

For older Android versions, ensure that the device is using the latest system libraries, or incorporate third-party TLS solutions such as Conscrypt to enable support for newer TLS protocols like TLS 1.2 or TLS 1.3.

Making Secure HTTPS Requests

Once the client is ready, use it to make API requests.

import okhttp3.OkHttpClient
import okhttp3.Request
import org.json.JSONObject

fun makeSecureRequest(client: OkHttpClient) {
    val request = Request.Builder()
        .url("https://yourfinancialdomain.com/api/endpoint")
        .get()
        .build()

    client.newCall(request).execute().use { response ->
        if (response.isSuccessful) {
            val jsonResponse = JSONObject(response.body?.string() ?: "")
            println("Response: $jsonResponse")
        } else {
            println("Error: ${response.code}")
        }
    }
}

• Request Building: Defines the target URL and HTTP method (GET in this case).
• Response Handling: Reads and parses the server’s response. Always handle errors to ensure reliability.

Key Points About TLS 1.3

• Backward Compatibility: TLS 1.3 supports backward compatibility with older versions (like TLS 1.2) by negotiating the highest mutually supported version.
• Performance: TLS 1.3 reduces round-trip times (RTTs) during handshakes, resulting in faster connection establishment, making it ideal for mobile apps.
• Security: TLS 1.3 deprecates weak cryptographic algorithms and only supports modern, secure encryption methods, ensuring enhanced security.

Testing HTTPS Communication

• Use Postman: Test your API endpoints, ensuring valid certificates are used and checking SSL/TLS connection aspects like certificate trust and hostname verification.
• Validate Pinning: Validate certificate pinning by changing the server’s certificate and ensuring that the client rejects untrusted connections. Ensure both server and client-side pinning implementations are correctly configured.
• Check TLS Version: Check the TLS version using tools like Wireshark, which can capture network traffic and verify if TLS 1.3 is being used, or use OpenSSL for command-line verification.

Best Practices for Secure HTTPS Communication

• Use Strong Encryption: Always enable the latest TLS protocols (preferably TLS 1.2 or 1.3) and ensure strong cipher suites are used for secure communication.
• Avoid Hardcoding Keys: Avoid hardcoding keys and sensitive data in your source code; use secure storage mechanisms like Android Keystore, EncryptedSharedPreferences, or secure servers to store such information.
• Monitor Dependencies: Monitor and regularly update libraries (e.g., OkHttp, Retrofit) to patch vulnerabilities. Use tools like Dependabot to stay up to date with security updates.
• Implement Error Handling: Implement robust error handling to manage network issues gracefully without exposing sensitive information. Provide meaningful feedback to users without revealing implementation details or errors.

Conclusion

Secure HTTPS (TLS 1.3) communication isn’t just a best practice — it’s a must for financial Android apps. With Kotlin and powerful tools like OkHttp, you can easily implement top-tier security without the hassle. By following these steps, you’ll not only protect sensitive data but also earn your users’ trust every step of the way.

Let’s secure the financial world, one app at a time..!