cho.sh

researchmini

3,249 notes

260722260722 I prefer TUIBB9A08 MarkRight8B0501 에이전트 런타임 서버 셋업1983DC Bun을 Rust로 재작성하다2BDED3 260721260721 Agent Runtime Server SetupC38C2C 260719260719 AutoBuilder63849A 260718260718 Slack Bots are the new CLIs3E662F 260717260717 WristcomputerD98BDF 260716260716 SalpakanA2940F AGENTS.mdDFE522 260714260714 260713260713 260712260712 260711260711 인간의 보완재와 AX41F1E5 260710260710 tokenmaxxing cli635294 260709260709

Storing sensitive data in iOS Apps · cho.sh

Storing sensitive data in iOS Apps

Storing sensitive data in iOS Apps

Warning

This post is more than a year old. Information may be outdated.

One way that doesn't work: Using environment variables

If you click the app name from the top bar in Xcode, you can edit scheme.

edit scheme

You can try settings values at Run → Arguments → Environment Variables and access them through ProcessInfo.processInfo.environment["KEY"].

ProcessInfo.processInfo.environment["KEY"]

However, this didn't work for me. Refer to this problem on Stack Overflow.
ProcessInfo.processInfo.environment variables work in Simulator but not on Device

One possible but unsafe way: `xcconfig`

Create .xcconfig and add them to app build settings.
Is it safe? No!

Backlinks1

Comments

Another possible buy unsafe way: `.gitignore`

I just made a .gitignore that ignores all *Credentials.swift file.
Is it safe? No!
However, I am using LinkedIn API that makes a network request.
Anyone who will take the effort to decompile the app and extract the API key data will attack the network request and extract the key.
I concluded security beyond not disclosing them through the source control system is meaningless for my use case.

One possible and safe way: Secure Enclaves.

What is a Secure Enclave? (Apple)
Storing Keys in the Secure Enclave (Apple)
Deploy the app without a secret key.
Access your server, download the information via HTTPS, and save it to the iOS secure enclave whenever you need the key.
But do you really want this layer of complexity?

Another possible (and probably the correct) way

Just don't store that level of sensitive information on the client.

Another another possible way that might be worth exploring

Using Keychain Manager.
- Keychain Services API Tutorial for Passwords in Swift
However, these are meant for storing personal sensitive data like usernames and passwords.
I am unsure if I can store data in Keychain without exposing it to the end-user or application (.ipa) file.
Apple Docs

Advanced Readings

Secret Management on iOS

Comments0

No comments yet. Be the first to share your thoughts.