title: Is this a "decent" encryption approach?
body: <p>I have an android app that connects to a back-end rails app. I want to encrypt the data I'm sending in-between devices and the server. I'm using basic encryption with a secret key. The key is not really that secret since I'm storing it on the apk and, as so, it's easily ex-tractable using reverse-engineering and apk decompiling techniques. </p>
  
  <p>What I've come up with is generating a secret key based on the user's password. Key's required to be of a fixed length, and seeing how forcing users to use super-long passwords it's not an option, what I'm doing is adding characters (basically the ones I was using in my old hard-coded key) so the string (password + characters) has the required length. I'm then encrypting all the parameters (I'm using a JSON for server-client communication) except the username (which technically shouldn't be encrypted so it's not a big deal). When the JSON request reaches the server, I'm using the username parameter to grab the user's password from the database (server-based) and then constructing the key I need to "de-encrypt/ encrypt" the data I'm receiving/sending. This way, the key is always the same between Server/Client but it's unique for every user and that way I don't have to store an easy-to-get, hardcoded key in my APK. Also, the password is not stored in the device, the users are required to enter the password every time they want to log into the server. </p>
  
  <p>What I want to know is, can this approach be considered "decently secured"?</p>