Question

Hey. I would like to save sensitive user data to my apps sandbox but I know that if the phone is then stolen someone can “rip” (if thats the correct term) data off the device quite easily.

So I need to use encryption. But I can’t use standard private-public keys without either storing them in the code. (not good im assuming as if the bundle is cracked they could be discovered)

Or using a secure connection to a server to transmit keys, which will mean my app will have to have internet to encrypt… not the best option for me.

So Im thinking of having the user enter a password or pin that will be used to encrypt the data (is that called a Hash?) but how secure is that? if someone ripped the hard drive of the phone and got my hash out. would they be able to decrypt all/any of it?

Cheers

Answer 1

This question addresses keeping a password safe for your app. Instead of a password, store a random key for encrypting a file, like this.

Don’t roll your own security code, your questions reveal you’re nowhere near being able to do that and get it right… keep reading, but for now follow these examples.