1

I asked a question on stack exchange meta recently for recommending a site for my question and they suggested Information security.

Question link: Where to ask about improvements for a security scenarios?

SO I need to know what modifications should I make to the question text/format for gaining more attraction to the question. and What tags should I use?

My question:

I'm building a mobile application that transfers points between users via QRCode. I'm concerned about security and am looking for effective simple yes secure algorithm to use.

The scenario should be something similar to this.

  1. User A wants to transfer X points to User B.
  2. User A generates a QR code on his mobile application, embeds the points number(X) and userA.id in the QR code.
  3. User B reads/scans the QR code, sends {pointsNumber:X, from=userA.id, to=userB.id} to the server.
  4. User A can generate the QRCode while offline, where user B must be online to read/scan the QRCode.
  5. The server receives the request and transfers X points from user A to user B.

The technical scenario we have for making this:

  • The server has a global value named salt. salt is random and auto generated every day.
  • In the server, every user has the following fields:
    • id: Auto Incriminate number.
    • userKey: md5( id + salt ) => changes every day.
    • generatedQRCodesNumberForToday: a number represents how many times the user generated a QRCode today, max value is 10, the value resets every day.
    • N: Array of already uses numbers in the current day while transferring points, the array resets everyday.
  • Every day, the user claims a new userKey.
  • Every user have a counter in his mobile application represents generatedQRCodesNumberForToday, this number is synced with the server whenever the user is online, and this number increases whenever the user creates an new QRCode.
  • If user A wants to transfer X points to user B:
    • User A creates a QRCode that has {from:userA.id, numberOfTrile:md5(userA.userKey + userA.generatedQRCodesNumberForToday), points:encode(userA.pointsToTransfer, userA.userKey)}.
    • User B reads the qr data, adds to:userB.id to them, and sends them to the server.
  • On server side:
    • The server receives the from field and knows who is the sender.
    • The server receives the to field and knows who is the receiver.
    • The server receives the points field and decodes is using the sender userKey to know the amount of points.
    • The server receives numberOfTrile field. The use of numberOfTrile field is to make sure that no user will generate the same QRCode more than once. The server tries to match numberOfTrile with {md5(from.userKey + '1'),...,md5(from.userKey + N),...,md5(from.userKey + '10')} where N was not used before, if there's a match then the transform process is approved and the number that matched the concatenation N is marked as not valid for future use.
  • 1
    Just ask the question and the community will make edits, add tags, and make suggestions. – schroeder Dec 23 '18 at 12:50
1

The problem with the post you suggest is that there isn't actually a question. You just describe your process. What is it that you want to ask?

Also, do you want attention or an answer? If you get an answer, does it matter how much attention you receive? Or are you wanting a lot of people to suggest a lot of different things?

  • I want to know if my process is secure or it has any security vulnerabilities. By attention I mean making the question easy to read and not hard to understand. and by that having more suggestions about improvements in the process and making it secure. – Yazan W Yusuf Dec 24 '18 at 7:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .