Protecting sensitive information in Objective C source code

Question

If I have a password variable that is used for remote SSL authentication, is it secure to store in the source code?

e.g.

NSString * password =  @"password";

Are there better way?

Update: Sorry for confusion, I am not storing the user password, instead, I am storing a password that is used to call our own backend, all the app will use the same password.

Community · Accepted Answer · 2017-05-23 12:17:10Z

2

My new answer:

Try not to use static passwords to access the back-end, period. What happens if somebody you don't want determines what that password is. Why not use usernames & passwords?

You can also consider using a public key or embedded certificate to allow only your app access to the back end servers.

My original answer:

Sounds like you want to get to know the Keychain.

Here's a tutorial that talks about it:

http://maniacdev.com/2011/07/tutorial-how-to-use-the-ios-keychain-to-store-names-and-passwords/

And here is a related question that talks about the security of Keychain under iOS.

You shouldn't have programs a store static password for all users, but instead have each user set up his/her account & password for authentication and then store that stuff in the keychain.

edited May 23, 2017 at 12:17

CommunityBot

11 silver badge

answered Mar 9, 2012 at 9:14

Michael Dautermann

89.7k18 gold badges174 silver badges223 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Howard Over a year ago

I have updated my question, I am not storing user password, instead, I am storing a password to call our backend, user don't know it.

Michael Dautermann Over a year ago

It would have been nice if your original question was a bit more clear to begin with. I've amended my answer.

Howard Over a year ago

Thanks! But even using a public key, is it easy to be detected by user, I am just thinking if there are better method to hide it some where in the code. I don't need to have a perfect way to do it, just better than storing as a string would be ok.

ArunMak Over a year ago

@Howard :I am also stuck up with the same issue .Did you find any way to hide the string inside your code?

Community · Accepted Answer · 2017-05-23 12:00:10Z

1

Any text contained within your application is easily extractable. There's no real way around this - using the strings tool, anyone can see any and all text content statically embedded into your app. However, there are some ways around this - notably, if you split up your string into several static strings and concatenate in the right order, it will be much more difficult to reverse engineer the password contained in your app.

I recommend you take a look at a similar question (How Safe is Information Contained within iPhone App Compiled Code), and specifically, my answer to that question, for a more in-depth explanation of what I mean. (Nimrod's comment on that question is also interesting.)

edited May 23, 2017 at 12:00

CommunityBot

11 silver badge

answered Mar 9, 2012 at 13:25

Itai Ferber

30.3k6 gold badges83 silver badges88 bronze badges

Comments

Pooria Azimi · Accepted Answer · 2012-03-09 09:16:23Z

0

NO!

build your app. Go to the terminal and type strings and then drag your executable to terminal and press return... You'll see your secret password in plain text :)

You should store its hash.

answered Mar 9, 2012 at 9:16

Pooria Azimi

8,6535 gold badges32 silver badges41 bronze badges

1 Comment

Howard Over a year ago

I have drag the executable into the strings terminal but it keep loading, nothing can be seen..

Collectives™ on Stack Overflow

Protecting sensitive information in Objective C source code

3 Answers 3

4 Comments

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

4 Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related