I have an iPhone app that will incorporate “liking” / “+1” with a global leaderboard of the highest ranking items. I’m communicating the +1 to the backend server over HTTPS. Additionally I’m using a password so that people can’t tamper with the results.
My dilemma is that the password is currently a hardcoded plaintext NSString which can be easily read if a jailbroken user goes looking in the app bundle.
Is the best solution simply to obfuscate the string, and then de-obfuscate it at runtime? Or am I going about this all wrong?
you can obfuscate it using a mix of characters C strings and objective-C string making it harder to find :
See this blog post about it
As well you can use some measleading #define directives
But I agree, these are only obfuscation “tricks”.