I'm writing an application for controlling computers from a client.
I'd very much like it if the connection is secure and only authenticated clients are allowed access.
The workflow will be something like this:
- A client use decides to add the server
- The server allows the client
- Alternative 1; On the server screen a X digit code is displayed that the client has to enter.
- Alternative 2; The server presents a dialog which the server user has to accept.
- The client and server exchanges keys to remember each other.
I understand that this initial communication won't be 100% secure unless the user manually verifies it, what's important is that future communications are secure.
What are good ways to make this as secure as possible?
None of the data sent is ATM sensitive so as a worst case only authentication is required.
If possible I would like to use HTTP(S) as the protocol.