Question

I need to send data from my iPhone application to my webserver, and back. To do this securely, I’m using an encryption algorithm. It requires a key that must be known by both the server and the user so that decryption can take place. I was thinking about just using a simple static string in my app and on the server as the key, but then I remembered that compiled code can still be disassembled and viewed, but only to a certain extent.

So, how safe would I be by placing the encryption methods and “secret” string in the source code of my app? Are there any other ways to accomplish communication between an app and server securely?

Thanks.

Answer 1

Yes, it can be found rather easily. Run the strings program on your executable and you’ll probably find it. Besides, anything in your program can be “found”, since it’s necessarily open for reading.

Use SSL for secure connections. It uses asymmetric encryption, which means the key to encrypt the data is not the same that will be required to decrypt it. That way, even if attackers find out your encryption key, they still can’t use it to decode. All major HTTP servers and client libraries support HTTPS, and that’s what it does.