I am creating an app and a website for a project I've got going, but I'm not sure what I should do about login. This is not a *"I'm a noob and I want an app with login"*-question. I am somewhat experienced with both web-, database- and app-development, but I've never actually touched the subject of *security* before other than by application templates.

What I'm imagining is a 'simple' login-system like Skype, Facebook, NetFlix, really any app that you are able to log in to, which also has a website to log in to.

A part of my question is towards the security of the process. My initial thought is that a password in clean text should never be sent over internet, which makes me believe that the passwords should be hashed/encrypted on the phone, as well on the website, when logging in. I've done some small-time hashing/encrypting before, but just by using `sha1` and `md5` to "convert" the text. What's the proper way to do this? With my current knowledge, I assume that if I'm using `md5` to encrypt a password, anyone could decrypt it with `md5` too, but that I could use a `SALT`(?) or some form for altering key. Is that how the "big boys" are doing it, or is there a secret passage I don't know of?

Now onto the real **question**.. How should I store a login securely?

What I've tried: When making a "test-project" in Xcode for this, I simply created a class `User` with a field for `username`. When "logging in" by entering a username and password, I simply sent a `POST`-method `HTTP-request` to my `.php`-page, which simply performed a `SELECT * FROM User WHERE Username = '$_POST['username']' AND Password = '$_POST['password']';` If the database returned one row, then the password was correct, and the page could print out the user in JSON or whatever. When the device got the successful login, I converted the user-object in the app, now containing the username (and potentially UserID, E-mail, Address etc.) to `NSData*`, and using `NSKeyedArchiver` and `NSKeyedUnarchiver` to save and load the user, never to authenticate again. If the user clicks "Log out", I wipe this 'archive'. This works, but I sense that it's not a particularly *secure* way of doing it. If so, why exactly is that?

(Our back-end is currently Google's App Engine(java), which has support for OAuth. Some are recommending this, but we can't find any proper documentation that makes sense for our plan with custom users)