- I'd recommend using HMAC rather than plain MD5 to generate signatures. Using MD5 alone exposes you to length extension attacks.
- You should consider putting a timestamp or nonce in the signature parameters to prevent replay attacks.
- The fact that you're able to validate that MD5(password) is correct implies that you're storing passwords insecurely.
- Consider switching your API endpoints to use HTTPS and sending the password unhashed. Hashing the password is not helping you here: since you're using the hashed value for authentication, any attacker who has it might as well have the actual password. Luckily, I don't believe this is as useful without also knowing the PSK, but it's still a design smell.
- I'd recommend using HMAC rather than plain MD5 to generate signatures. Using MD5 alone exposes you to length extension attacks.
- You should consider putting a timestamp or nonce in the signature parameters to prevent replay attacks.
- The fact that you're able to validate that MD5(password) is correct implies that you're storing passwords insecurely.
- Consider switching your API endpoints to use HTTPS and sending the password unhashed. Hashing the password is not helping you here: since you're using the hashed value for authentication, any attacker who has it might as well have the actual password. Luckily, I don't believe this is as useful without also knowing the PSK, but it's still a design smell.