Best practice: How do I secure Http-Requests (eg Login) from a mobile application
We have a web-application which provides a simple "Generic Http-Handler" (ASP.NET) for providing an easy way to get a session for a mobile-application.  
Atm the wohle concept/application is in a demo/alpha/test-state - so don't throw your hands up in horror... :)

I realized that there are several security issues:

 - If the mobile device is connected to WLAN (as the needed sniff-routine is quite easy), you could simply sniff the Request (to get the value for username/password) and/or Response (to reuse the session somewhere else)
 - We could add some encryption/decryption, but as we are on android, anyone can unpack the `.apk`-file and do some reverse engineering to get the shared-key (and salt)
 - We could use https:// ... but ... I am interested if there's another way...

Some side-nodes:  
As we plan to give our customers a possibility to access our web-application (the handler is just a part of it) with a mobile-application, wo do not really care about publishing it on the market... But maybe this will change. So atm the plan does not include a "public give-away" of the `.apk`.

I already did some research on the issue "How to adapt the response, so that only the mobile-application can effectively use it" (eg http://stackoverflow.com/questions/2651844/how-do-i-secure-a-net-web-service-for-use-by-an-iphone-application).


I believe that this must be a more general problem, which is not only somethig to think about if you are on android/co... So "Best Practice" may not only be limited to android (you would have the same scenario on iphone or winforms too) - it's more about: how to deal with a remote component to execute vital functions (eg login, db-access, ...)

Thanks in advance!
Best practice: How do I secure Http-Requests (eg Login) from a mobile application
===

We have a web-application which provides a simple "Generic Http-Handler" (ASP.NET) for providing an easy way to get a session for a mobile-application.  
Atm the wohle concept/application is in a demo/alpha/test-state - so don't throw your hands up in horror... :)

I realized that there are several security issues:

 - If the mobile device is connected to WLAN (as the needed sniff-routine is quite easy), you could simply sniff the Request (to get the value for username/password) and/or Response (to reuse the session somewhere else)
 - We could add some encryption/decryption, but as we are on android, anyone can unpack the `.apk`-file and do some reverse engineering to get the shared-key (and salt)
 - We could use https:// ... but ... I am interested if there's another way...

Some side-nodes:  
As we plan to give our customers a possibility to access our web-application (the handler is just a part of it) with a mobile-application, wo do not really care about publishing it on the market... But maybe this will change. So atm the plan does not include a "public give-away" of the `.apk`.

I already did some research on the issue "How to adapt the response, so that only the mobile-application can effectively use it" (eg http://stackoverflow.com/questions/2651844/how-do-i-secure-a-net-web-service-for-use-by-an-iphone-application).


I believe that this must be a more general problem, which is not only somethig to think about if you are on android/co... So "Best Practice" may not only be limited to android (you would have the same scenario on iphone or winforms too) - it's more about: how to deal with a remote component to execute vital functions (eg login, db-access, ...)

Thanks in advance!