Question

If I have a password variable that is used for remote SSL authentication, is it secure to store in the source code?

e.g.

NSString * password =  @"password";

Are there better way?

Update: Sorry for confusion, I am not storing the user password, instead, I am storing a password that is used to call our own backend, all the app will use the same password.

Answer 1

My new answer:

Try not to use static passwords to access the back-end, period. What happens if somebody you don’t want determines what that password is. Why not use usernames & passwords?

You can also consider using a public key or embedded certificate to allow only your app access to the back end servers.

My original answer:

Sounds like you want to get to know the Keychain.

Here’s a tutorial that talks about it:

http://maniacdev.com/2011/07/tutorial-how-to-use-the-ios-keychain-to-store-names-and-passwords/

And here is a related question that talks about the security of Keychain under iOS.

You shouldn’t have programs a store static password for all users, but instead have each user set up his/her account & password for authentication and then store that stuff in the keychain.