I've experience of system design and programming but not of internet security. Can someone help to determine if the following design is reasonably secure?
The system consists of two parts:
Firstly a website / server (secured with SSL) which displays a map and plots a breadcrumb trail of a user's location. Friends & relatives, given a password by the user, can log in and see where users are located and where they've been (e.g. for the last 24 hours).
Secondly, a phone app which sends GPS data up to the server. The main design consideration of the latter is to keep location messages as short as possible, to minimise both battery life and the user's data allowance. So I don't really want to use SSL for sending messages from the phone (it will add a large overhead to an otherwise small message - probably sent every minute). It also adds to the app's complexity and size.
My proposed solution is the following:
When registering (via the website) the system creates a hash for the user, based on username and password, which is stored in the database as a 'user ID' (this would be a different hash from one used to just store the password). Possibly SHA512 although that might be unneccesarily long.
When installing the app on their phone, users would enter username & password. The app then uses the same hash algorithm, and sends the hash value to the server via a non-SSL endpoint. If recognised, the server responds OK and the app stores the hash as a user ID.
While the app is running, every time a new location is noted it is sent, along with a timestamp and the user ID, to the server (again non-SSL). The server stores the data accordingly against the correct user ID.
The server would be running two separate web services, one SLL and one not, both talking to the same database.
There's probably a flaw here somewhere, please let me know if so! The security consideration is, of course, that someone who hasn't been given a password should not be able to see a user's whereabouts. Thanks in advance.