I would like to create a mobile game which communicates with my own backend server.
For authentication I want to use google Sign-in(https://developers.google.com/identity/sign-in/android/backend-auth), so users don't need to create an account.
My backendserver uses a TCP connection to communicate with the client and I don't want to send the google login auth code unencrypted over the network. I read alot about SSL encryption, but I'm not sure if it is the thing I need and if this is sufficient.
Another question I would like to ask is do I need to encrypt all packets my client is sending to the server. Because when I just do authentication over an encrypted connection, potential hackers could simply perform a man-in-the-middle attack to access the account of a player after they logged in.
So what would be the best way to send this token to the server, is SSL sufficient for this and do I need to encrypt the whole traffic my game creates?